CVE-2026-98311

A flaw was found in the Linux kernel's virtwifi driver. A local user can exploit this vulnerability by attempting to create a virtual network interface with an invalid name while the underlying network device is dormant. Due to improper initialization handling, the system prematurely frees memory...

CVE-2026-83632

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS or memory corruption by sending specially crafted network requests to services utilizing the C++ HTTP transport layer. Due to improper input validation and resource handling, these requests trigger an integer...

CVE-2026-108039

A flaw was found in Apache CXF. By default, the XML parsing utility does not enforce limits on the total number of elements or characters within an incoming XML document. A remote attacker could exploit this vulnerability by sending an excessively large XML request, causing the application to...

CVE-2026-107937

A flaw was found in Apache CXF. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a crafted multipart request containing excessively large or repeated attachment headers. Because the parser fails to properly enforce size and count limits on multi-line and repeated...

CVE-2026-78384

A flaw was found in Apache CXF. A remote attacker can trigger a Denial of Service DoS by submitting specially crafted compressed data during token processing. Because the system decompresses incoming data without enforcing a maximum output size limit, a small payload can consume excessive heap...

CVE-2026-75346

A flaw was found in OpENer. An out-of-bounds read vulnerability in the server-side Common Industrial Protocol CIP SetAttributeList service allows a remote attacker to cause a Denial of Service DoS. By sending specially crafted network requests, an attacker can trigger an invalid memory read,...

CVE-2026-48484 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

EUVD-2026-95910

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

AZL-106919 CVE-2026-102554 affecting package guava 33.0.0-1

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

AZL-107988 CVE-2026-102554 affecting package javapackages-bootstrap 1.14.0-4

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

CVE-2026-107815 MariaDB: one byte OOB write in DOS tables of the CONNECT engine

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

EUVD-2026-95909

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

CVE-2026-107815 MariaDB: one byte OOB write in DOS tables of the CONNECT engine

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

CVE-2026-107815

The MariaDB server (versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2) contains a one-byte out-of-bounds (OOB) write in the CONNECT engine 's DOS table type. The vulnerability is caused by an incorrect boundary check , allowing an attacker-controlled offset to trigger...

CVE-2026-107815 MariaDB: one byte OOB write in DOS tables of the CONNECT engine

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

CVE-2026-39453

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots...

CVE-2026-107806

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

CVE-2026-108102

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogspfcpparsevolumemeasurement in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags...

CVE-2026-107805

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...

CVE-2026-104115

A stack-based buffer overflow in the illumos reparse point daemon reparsed allows a local user to crash the daemon. getfslocations in usr/src/cmd/fs.d/nfs/rpbasic/libnfsbasic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte...