EUVD-2026-93512

Payload: Unauthenticated account-lockout denial of service...

EUVD-2026-93775

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers...

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

Summary A single AMQP message with malformed UTF-8 in a shortstr property for example correlation-id can permanently disable a Java client RPC consumer. The client decodes malformed bytes into U+FFFD replacement characters. Each of those re-encodes to 3 bytes, so a 255-byte property becomes 765...

ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

Summary ImageSharp's TIFF CCITT Group 3 T4 encoder can write beyond its allocated compressed-data buffer when encoding narrow 1-bit images. The unchecked writes can corrupt process memory and terminate the process. This report concerns only the T4 CcittGroup3Fax encoder path. It replaces the prio...

GHSA-J3P4-WP97-RPH4 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

Summary SixLabors.ImageSharp can terminate a process when an application decodes an attacker-supplied 32-bit floating-point TIFF as Image and applies HistogramEqualization. An IEEE positive-infinity TIFF sample reaches a non-finite or otherwise out-of-range HalfVector4 component, depending on the...

NPM: Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

NPM: Quasar Framework: DOM Clobbering in Quasar openURL SafariViewController Integration Causes Client-Side Denial of Service vulnerability discovered by ? in WordPress Npm quasar versions = 2.32.1...

GHSA-JRFJ-FHJ2-JJVM Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Opening a file whose first eight bytes are the OLE magic number sends excelize down the decryption path whether or not the caller set a password, or supports encrypted workbooks at all. openReaderAt excelize.go:198-215 branches on the header alone, and agileDecrypt calls convertPasswdToKey before...

Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Opening a file whose first eight bytes are the OLE magic number sends excelize down the decryption path whether or not the caller set a password, or supports encrypted workbooks at all. openReaderAt excelize.go:198-215 branches on the header alone, and agileDecrypt calls convertPasswdToKey before...

Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process

Summary The max attribute of a element in xl/worksheets/sheetN.xml is read verbatim on open with no check against MaxColumns, and flatCols then walks Min..Max doing a deepcopy.Copy and append per iteration. Executed: max="300000", only about 18x past the real 16384 limit, cost 46.2 s of CPU and 1...

GHSA-FQ3V-74GV-27GM Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process

Summary The max attribute of a element in xl/worksheets/sheetN.xml is read verbatim on open with no check against MaxColumns, and flatCols then walks Min..Max doing a deepcopy.Copy and append per iteration. Executed: max="300000", only about 18x past the real 16384 limit, cost 46.2 s of CPU and 1...

CVE-2026-97716

CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service...

CVE-2026-1403 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2026-97717 Denial of Service in Absolute Secure Access

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

CVE-2026-107221

creationtimestamp| type| source ---|---|--- 2026-10-07 19:53:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i5smj5dsbzi2n 2026-10-07 20:23:08+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-8mcq-6wmr-jrjv...

CVE-2026-97715

A vulnerability exists in the client registration process of Secure Access servers prior to version 14.60 . Authenticated attackers can exploit this by passing malformed data to the server, resulting in a persistent denial of service . No specific exploit details or remediation steps are provided...

CVE-2026-97715 Denial of Service in Absolute Secure Access

CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior to version 14.60. Authenticated attackers can pass malformed data to the server and cause a persistent denial of service...

USN-8900-1: Go Networking vulnerabilities

It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could cause the connection to hang. A remote attacker could possibly use this issue to cause a denial of service. CVE-2022-27664 It was discovered that ...

EUVD-2026-94556

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that...

CVE-2026-107222 Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure. GetConditionalFormats reaches...

EUVD-2026-94549

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes...