CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-59679

CVE-2026-59679 affects the libXfont2 font-server client (X.Org X11). The function fs_read_glyphs() in src/fc/fserve.c indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated based on num_extents from the separate FS_QueryXExtents16 reply—two fi...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CLEANSTART-2026-JY79008 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Multiple security vulnerabilities affect the apache-hive package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-VO23255 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the metallb package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

ALSA-2026:66364 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

CVE-2026-89044: Inconsistent Interpretation of HTTP Requests

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

PT-2026-89523

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.133.Final through 4.1.137.Final Netty versions 4.2.13.Final through 4.2.17.Final Description Improper validation of the final transfer coding in the Transfer-Encoding header allows attackers to perform request smuggling usin...

Linux Distros Unpatched Vulnerability : CVE-2026-89044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the...

ROS-20260910-73-0003

The vulnerability in mupdf is related to a lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows an attacker operating remotely to gain access to confidential data...

Linux Distros Unpatched Vulnerability : CVE-2026-30754

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nalsend function in libavformat/rtpench264hevc.c, a negative siz...

RHEL 9 : git-lfs (RHSA-2026:66364)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:66364 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...

cowlib: cowlib: Link header smuggling allows out-of-band connections to attacker-controlled origins

A flaw was found in ninenines cowlib. This vulnerability, due to improper encoding or escaping of output, allows an attacker to perform Link header directive smuggling. By manipulating the target URI, 'rel' value, or attribute keys in applications that process Link headers through cowlib, a remot...

CVE-2026-87927

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

EUVD-2026-75109

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

CVE-2026-87927

MaxSite CMS through version 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers. By supplying base64-encoded path traversal sequences, unauthenticated attackers bypass path validation checks and execute admin-gated handler actions without authentication...

CVE-2026-87927 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...