CVE-2026-86566

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK...

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395

The Model Context Protocol Java SDK is vulnerable to memory exhaustion due to unbounded request bodies in certain server transports. Specifically, the Servlet-based SSE , Streamable HTTP , and Stateless server transports fail to enforce a maximum size when reading HTTP request bodies into memory....

EUVD-2026-101503

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-106464

The _nx_secure_x509_parse_signature_data function is vulnerable to an integer underflow and out-of-bounds read due to a lack of check on the tlv_length variable. If a certificate contains an empty ASN.1 BIT STRING signature, the function computes a length of 0xFFFFFFFF and sets a pointer one byte...

CVE-2026-106464

nxsecurex509parsesignaturedata computes the certificate signature's length as tlvlength - 1 without first checking that tlvlength is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of 0xFFFFFF...

EUVD-2026-101502

nxsecurex509parsesignaturedata computes the certificate signature's length as tlvlength - 1 without first checking that tlvlength is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of 0xFFFFFF...

CVE-2026-106464

nxsecurex509parsesignaturedata computes the certificate signature's length as tlvlength - 1 without first checking that tlvlength is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of 0xFFFFFF...

CVE-2026-107349

The database connection pooler PgBouncer (versions 1.20.0 through 1.26.0) contains an infinite loop vulnerability. An unauthenticated remote attacker can cause a denial of service by sending a StartupMessage where the options parameter contains an empty parameter name (e.g., -c=). This causes the...

EUVD-2026-101499

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...

CVE-2026-107349

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...

DEBIAN-CVE-2026-96596

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Erlang OTP stdlib erltar module, hexpm hexcore hexerltar module, hexpm hex mixhexerltar module and erlang rebar3 r3hexerltar module allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU...

CVE-2026-101964 Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message

A Reachable Assertion vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session...

CVE-2026-92155

The F´ (F Prime) framework, used for spaceflight and embedded software, contains a vulnerability in the Fw::FilePacket deserialization used by Svc::FileUplink . Prior to version 4.2.0 , the system fails to validate the range of the byte cast to the Type enum during Header deserialization. If a ne...

CVE-2026-92155 F´: FileUplink Unknown Packet Type Assertion DoS

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its ran...

CVE-2026-75084

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...

DEBIAN-CVE-2026-67418

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmqmqtt/src/rabbitmqttpacket.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated...

CVE-2026-92150 F´: GenericHub Malformed Buffer Assertion DoS

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriverhandler deserialization is vulnerable because the receive handler uses FWASSERT for externally influenced deserialization stat...

CVE-2026-105659

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...