CVE-2026-107168

A flaw exists in m17n-lib where providing crafted input with an invalid UTF-8 character sequence can cause the text parsing function count_utf_8_chars() to enter an infinite loop . This vulnerability leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected ...

CVE-2026-107168 M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service DoS for the affected application...

CVE-2026-107159

A flaw was found in miniupnpd. An unauthenticated attacker on the adjacent network can exploit this vulnerability to cause a Denial of Service DoS by crashing the service. By sending a specially crafted Simple Service Discovery Protocol SSDP search request with an invalid delay value, the attacke...

CVE-2026-107159

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and...

kernel: vsock/vmci: fix UAF when peer resets connection during handshake

A flaw was found in the vsock/vmci component of the Linux kernel. A remote attacker could exploit a Use-After-Free UAF vulnerability when a peer resets a connection during the handshake process. This occurs because the system incorrectly handles reset packets, leading to a pending socket being le...

CVE-2026-107159 MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and...

CVE-2026-107159

MiniUPnPd versions through 2.3.11 built with the --strict flag are vulnerable to a divide-by-zero vulnerability in the ProcessSSDPData() function. An unauthenticated attacker on the local network can crash the daemon by sending a single multicast M-SEARCH datagram to port 1900 featuring an MX: 0 ...

EUVD-2026-94308

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and...

CVE-2026-107159 MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and...

CVE-2026-107159 MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and...

CVE-2026-105838

A flaw was found in libmikmod. An out-of-bounds read vulnerability in the Impulse Tracker IT module loader can result in a Denial of Service DoS. By persuading a user to open a specially crafted IT audio file containing oversized pattern rows, an attacker can trigger a memory read past allocated...

Security Bulletin: InfoSphere Data Architect (IDA) 9.2.2 Vulnerability Fixes

Summary Security Bulletin: Multiple vulnerabilities getting fixed with InfoSphere Data Architect IDA 9.2.2. Hence, IBM strongly recommends upgrading to v9.2.2 Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or...

CVE-2015-7547-master

Мы предоставляем этот код как есть. Вы несёте ответственность за защиту себя, своего имущества и данных, а также других лиц от любых рисков, вызванных этим кодом. Этот код может вызывать неожиданное и нежелательное поведение на вашем компьютере. Этот код может не обнаружить уязвимость в вашей...

sudo-1.8.3p1-patched

sudo-1.8.3p1-patched Ceci est une version personnalisée de sudo, basée sur le paquet sudo 1.8.3p1 tel que fourni par Canonical pour Ubuntu 12.04 en utilisant les URL ci-dessous, avec les correctifs CVE-2021-3156 appliqués...

K000163575: Python vulnerabilities CVE-2026-4360 and CVE-2026-57585

Security Advisory Description CVE-2026-4360 In the Tarfile.extract function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing...

CVE-2026-98360

A flaw was found in the Linux kernel's Remote Direct Memory Access over Converged Ethernet RDMA/rxe driver. A local user can trigger a Denial of Service DoS or system crash by attempting to attach to a multicast group when network device operations fail. In this scenario, improper error handling...

CVE-2026-98172

A flaw was found in the Linux kernel's Server Message Block SMB client subsystem. When establishing a Remote Direct Memory Access RDMA session, an error during session initialization can cause the cleanup routine to release the session structure without first terminating the active RDMA connectio...

CVE-2026-78148

A flaw was found in the ggml-RPC Server component of llama.cpp. A remote attacker can exploit this vulnerability by performing a specific manipulation, leading to a null pointer dereference. This can result in a Denial of Service DoS, making the affected system unavailable. Mitigation For systems...

CVE-2026-98359

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem. When an asynchronous RDMA port query retrieves link speed settings, the kernel fails to verify whether the associated network device is being unregistered before invoking its operations. A local user could exploit...

kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker ...