BIT-LIBPYTHON-2026-19445 Use-after-free of a server-side SSLContext when sni_callback switches contexts

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

BIT-APISIX-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

EUVD-2026-95704

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input for example SAAJ or WS-Security, and could...

CVE-2026-108039

The Apache CXF framework contains a vulnerability where StaxUtils fails to enforce limits on the total number of elements or characters in an XML document by default. This flaw allows an attacker to send an excessively large XML request, leading to excessive CPU and memory consumption during pars...

CVE-2026-108039 Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input for example SAAJ or WS-Security, and could...

EUVD-2026-95698

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

CVE-2026-78384

A vulnerability exists in Apache CXF (specifically the org.apache.cxf:cxf-core component) where the CompressionUtils.inflate() function fails to enforce an output-size cap when decompressing DEFLATE data. A remote attacker can exploit this by submitting a small, crafted payload that expands into ...

CVE-2026-78384 Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...

EUVD-2026-95696

CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...

CVE-2026-98211

A flaw was found in the Linux kernel's MultiMediaCard MMC host controller interface driver. When the device is removed, the driver fails to cancel pending delayed timeout tasks, allowing scheduled work to access memory that has already been released. A local user capable of triggering device...

CVE-2026-98253

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access subsystem. A local attacker can cause a Denial of Service DoS or memory corruption by exploiting a race condition in the User Connection Manager Access ucma component. This issue occurs when concurrent multicast join requests...

CVE-2026-98210

A flaw was found in the Linux kernel's mxcmmc host driver. A local user with administrative privileges could trigger this vulnerability by unbinding or removing the device, leading to a Denial of Service DoS or potential arbitrary code execution. The driver fails to cancel active background tasks...

CVE-2026-78013

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information...

CVE-2026-104635

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

CVE-2026-107655

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Interne...

CVE-2026-98278

A flaw was found in the Linux kernel. A local privileged user with network administration capabilities can configure a routing loop on an IP tunnel interface. When offloading network traffic through the misconfigured tunnel, the system triggers an unexpected kernel warning, potentially leading to...

CVE-2026-98208

A flaw was found in the Linux kernel's SDIO UART driver. When registering a new device port while all available port slots are occupied, the driver fails to release an allocated transmit buffer during error handling. A local user could exploit this flaw by repeatedly triggering failed device...

CVE-2026-107655

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Interne...

CVE-2026-107655

A vulnerability exists in CUPS where improper handling of specific IPP attributes while processing embedded job ticket comments leads to an unhandled null pointer dereference . An unauthenticated attacker capable of submitting jobs to a shared printer queue can exploit this by sending a crafted I...

CVE-2026-107655 Cups: null pointer dereference via embedded job ticket comments allows remote denial of service

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Interne...