CVE-2026-106572

A flaw was found in ImageMagick. A remote attacker can trigger a Denial of Service DoS by submitting a specially crafted Continuous Acquisition and Life-cycle Support CALS raster image for processing. Due to a missing recursion depth limit in the CALS decoder, parsing the malicious file exhausts...

CVE-2026-106571

A flaw was found in ImageMagick. A local attacker can cause a Denial of Service DoS by issuing a specially crafted call to the GetVirtualPixels function. An integer calculation error allows data to be written beyond allocated heap memory boundaries, resulting in an unexpected process crash...

CVE-2026-107214 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values...

CVE-2026-106570

A flaw was found in ImageMagick. An unauthenticated attacker on an adjacent network can cause a Denial of Service DoS by repeatedly establishing connections to the distributed pixel cache server. This behavior exhausts the pool of available connections, preventing legitimate clients from accessin...

CVE-2026-106568

A flaw was found in ImageMagick. A remote attacker could submit a specially crafted image containing a malformed Extensible Metadata Platform XMP profile, causing the parser to enter an infinite loop during processing. Successful exploitation can result in a Denial of Service DoS by hanging the...

CVE-2026-106567

A flaw was found in ImageMagick. An attacker can cause a Denial of Service DoS by providing a specially crafted Photoshop Document PSD file for processing. Due to an integer-conversion error in the PSD decoder on 32-bit systems, the application enters an infinite loop, causing it to hang and beco...

CVE-2026-106564

A flaw was found in ImageMagick. A remote attacker can cause a Denial of Service DoS by providing a specially crafted OpenEXR EXR image file. Due to improper bounds checking in the EXR decoder, processing the image causes the application to write beyond the allocated memory buffer and crash...

CVE-2026-80855

A flaw was found in the Linux kernel's Filesystem in Userspace FUSE component. A local user could exploit this by opening a file with the OTRUNC flag, which attempts to truncate the file. If a signal interrupts the Direct Access DAX page invalidation process during this operation, a lock can be...

CVE-2026-80811

A flaw was found in the Linux kernel's iouring/cmd component. This vulnerability allows for a memory leak due to iovec arrays not being properly freed when asynchronous commands are not recycled. An attacker could potentially exploit this by triggering specific workloads, such as NVMe passthrough...

CVE-2026-93515

A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local ...

CVE-2026-93519

A flaw was found in xorg-x11-server. The server writes pointer barrier events into a fixed-size buffer without properly validating boundaries. An authenticated client can trigger this issue by configuring excessive pointer barriers and generating cursor motion events, causing a buffer overflow...

CVE-2026-80784

A flaw was found in the Linux kernel's Multipath TCP MPTCP component. A race condition exists during socket teardown and concurrent userspace Multipath TCP MPTCP general announce operations. This can allow a local attacker to trigger a memory leak by causing an allocation to occur after a list ha...

CVE-2026-76454

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This...

CVE-2018-10546

CVE-2018-10546 A user can create specially crafted data that, when processed using a stream filter with 'convert.iconv.', will cause the target application to enter an infinite loop and consume excessive CPU resources CVE-2018-10546. The specific impact of these vulnerabilities depends on the...

CVE-2026-107211 Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while...

cve-2026-34473-unauthenticated-dos-zte-routers

CVE-2026-34473: Unauthenticated Denial of Service in ZTE Routers affecting 140K+ devices worldwide 17+ models Technical breakdown of CVE-2026-34473, published from the original disclosure set and firmware-analysis artifacts. Live site:...

EUVD-2026-93873

Twisted: IMAP wildcardToRegexp ReDoS...

Twisted: IMAP wildcardToRegexp() ReDoS

Summary wildcardToRegexp in twisted/mail/imap4.py converts IMAP LIST/LSUB wildcard patterns to Python regular expressions. It substitutes the two IMAP wildcards → ?:.? and % → ?:?:^\/? but passes every other character through unchanged to re.compile. This means that an authenticated IMAP client...

GHSA-4V53-57PG-C464 yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

Summary LZ4BlockInputStream grows its compressed-input buffer to the attacker-controlled compressedLen value from the legacy LZ4Block stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap. Details In...

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

Summary LZ4BlockInputStream grows its compressed-input buffer to the attacker-controlled compressedLen value from the legacy LZ4Block stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap. Details In...