CVE-2026-102998

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/appearancestream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled,...

CVE-2026-102146 Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...

CVE-2026-102997

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that...

CVE-2026-102098 Kiteworks Core SQL Injection

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service...

CVE-2026-102994

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through...

CVE-2026-102993

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/pagelabels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of...

CLEANSTART-2026-PA36556 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

Security vulnerability affects the containerd package. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources...

CLEANSTART-2026-LC87549 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

Security vulnerability affects the containerd package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...

CLEANSTART-2026-LI38180 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

Security vulnerability affects the containerd package. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop...

CLEANSTART-2026-DE50350 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the containerd package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CLEANSTART-2025-ST85629 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Security vulnerability affects the containerd package. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service...

CLEANSTART-2025-JL64950 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Security vulnerability affects the containerd package. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service...

CLEANSTART-2026-OH69104 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened

Security vulnerability affects the coredns package. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened...

CLEANSTART-2026-DV62893 processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

Security vulnerability affects the buildkitd package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input...

EUVD-2026-90254

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

CVE-2026-101881 OpenClaw Windows Node before 2026.7.1 Denial of Service

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

CVE-2026-93126

A flaw was found in the Linux kernel's remoteproc subsystem, specifically within the qcomq6v5adsp driver. When the adspmapcarveout function is called, it fails to properly release a device node reference. This oversight can lead to a reference leak, potentially causing resource exhaustion over ti...