CVE-2026-107214

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values...

Security Bulletin:body-parser Limit Validation Vulnerability in Versions Prior to 1.20.6 and 2.3.0

Summary Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit...

Exploit for CVE-2026-102253

CVE-2026-102253-POC DOS infinite-loop Vulnerability POC Su...

CVE-2026-107215

The Excelize Go library (versions 2.3.1 to 2.11.0 ) is vulnerable to a remote panic or Out-of-Memory (OOM) Denial of Service due to improper validation of CFB directory-entry sizes. The extractPart function trusts the streamSize for EncryptionInfo and EncryptedPackage allocations before validatin...

CVE-2026-107215 Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory...

CVE-2026-107215 Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory...

CVE-2026-107210

A flaw was found in ImageMagick. A remote attacker could exploit this vulnerability by submitting a specially crafted, highly compressed MATLAB MAT image file for processing. When decompressing the file, the decoder creates temporary files exceeding configured security policy limits, bypassing...

CVE-2026-107208

A flaw was found in ImageMagick. When processing a specially crafted Extensible Metadata Platform XMP profile, the software triggers an internal recursion limit that is handled as a fatal condition rather than a standard exception. A remote attacker can exploit this vulnerability by submitting a...

Security Bulletin:Netty Bzip2Decoder Handler Vulnerability: Denial of Service via Malformed bzip2 Stream

Summary Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-106578

A flaw was found in ImageMagick. This vulnerability can lead to a Denial of Service DoS when the software processes untrusted input. A remote attacker could submit a specially crafted image file that triggers an invalid memory free condition in the Magick Vector Graphics MVG decoder, causing the...

CVE-2026-106576

A flaw was found in ImageMagick. A remote attacker can cause a Denial of Service DoS by submitting an image containing a specially crafted Extensible Metadata Platform XMP profile. When ImageMagick processes the profile, calculating the numerator and denominator of a rational value triggers...

CVE-2026-106573

A flaw was found in ImageMagick. A missing limit check in the Magick Vector Graphics MVG decoder allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted image file. Processing this malicious input triggers an excessively long-running operation that exhausts syst...

CVE-2026-106572

A flaw was found in ImageMagick. A remote attacker can trigger a Denial of Service DoS by submitting a specially crafted Continuous Acquisition and Life-cycle Support CALS raster image for processing. Due to a missing recursion depth limit in the CALS decoder, parsing the malicious file exhausts...

CVE-2026-106571

A flaw was found in ImageMagick. A local attacker can cause a Denial of Service DoS by issuing a specially crafted call to the GetVirtualPixels function. An integer calculation error allows data to be written beyond allocated heap memory boundaries, resulting in an unexpected process crash...

CVE-2026-107214 Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values...

CVE-2026-106570

A flaw was found in ImageMagick. An unauthenticated attacker on an adjacent network can cause a Denial of Service DoS by repeatedly establishing connections to the distributed pixel cache server. This behavior exhausts the pool of available connections, preventing legitimate clients from accessin...

CVE-2026-106568

A flaw was found in ImageMagick. A remote attacker could submit a specially crafted image containing a malformed Extensible Metadata Platform XMP profile, causing the parser to enter an infinite loop during processing. Successful exploitation can result in a Denial of Service DoS by hanging the...

CVE-2026-106567

A flaw was found in ImageMagick. An attacker can cause a Denial of Service DoS by providing a specially crafted Photoshop Document PSD file for processing. Due to an integer-conversion error in the PSD decoder on 32-bit systems, the application enters an infinite loop, causing it to hang and beco...

CVE-2026-106564

A flaw was found in ImageMagick. A remote attacker can cause a Denial of Service DoS by providing a specially crafted OpenEXR EXR image file. Due to improper bounds checking in the EXR decoder, processing the image causes the application to write beyond the allocated memory buffer and crash...

CVE-2026-80855

A flaw was found in the Linux kernel's Filesystem in Userspace FUSE component. A local user could exploit this by opening a file with the OTRUNC flag, which attempts to truncate the file. If a signal interrupts the Direct Access DAX page invalidation process during this operation, a lock can be...