CVE-2026-110459

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service DoS attack on the device...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.5 Vulnerability Details CVEID:CVE-2016-1000027 DESCRIPTION: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data...

MGASA-2026-0502 Updated apache package fixes security vulnerabilities

Limited RCE for some internal redirects to non-CGI files in CGI directories. CVE-2026-42356 moddav shared lock overflow. CVE-2026-42528 modheartmonitor denial of service. CVE-2026-46729 modsession: Session cookie not removed during internal redirect. CVE-2026-47360 modauthdigest reauthentication...

CVE-2026-95839

Impact A bug in containerd's image manifest processing causes an unrecovered panic when a child descriptor contains the "io.containerd.manifest.subject" annotation and a malformed digest. Pulling or importing such an image through the transfer service including default CRI "PullImage" requests...

CLEANSTART-2026-OI68179 BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli

Security vulnerability affects the openjdk11 package. The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...

CLEANSTART-2026-QO62654 DOS / potential heap overwrite in mkv demuxing using bzip decompression

Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using bzip decompression...

CLEANSTART-2026-VZ54058 DOS / potential heap overwrite in mkv demuxing using zlib decompression

Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using zlib decompression...

CLEANSTART-2026-SR74236 DOS / potential heap overwrite in qtdemux using zlib decompression

Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in qtdemux using zlib decompression...

CLEANSTART-2026-EK48712 DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression

Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression...

CLEANSTART-2026-MO53582 DOS / potential heap overwrite in mkv demuxing using lzo decompression

Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using lzo decompression...

CLEANSTART-2026-IQ56937 libjpeg 9c has a large loop because read_pixel in rdtarga

Security vulnerability affects the libjpeg-turbo package. libjpeg 9c has a large loop because readpixel in rdtarga...

CLEANSTART-2026-NY89801 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

EUVD-2026-100747

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with unsupported or non-canonical HTTP methods to an existing static path. Because the application encounters an unhandled panic before authentication is evaluated, these...

CVE-2026-110602: Access of Uninitialized Pointer

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an...

PT-2026-114044

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd open in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an...

CVE-2026-110257: Memory Allocation with Excessive Size Value

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

CVE-2026-110659: NULL Pointer Dereference

ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocationsectionaccessor getentry that allows attackers to crash applications via an unvalidated shlink index. Attackers can supply a crafted ELF file whose SHTREL or SHTRELA section has a dangling shlink, causing...

CVE-2026-110596: Excessive Iteration

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...