undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

DEBIAN-CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

UBUNTU-CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

CVE-2026-87080

The Net::IDN::Punycode::PP Perl module (versions before 2.590 ) contains a vulnerability where the pure-Perl decoder incorrectly processes truncated labels in the decode_punycode function. The root cause is that the four-argument substr function returns an empty string instead of undef when exhau...

CVE-2026-87080 Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

ROS-20260922-73-0093

The vulnerability of the l2capecredreconfrsp function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to synchronization errors. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility...

ROS-20260922-73-0100

The vulnerability of the bpfiterunixseqshow function in the net/unix/afunix.c module of the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility ...

PT-2026-96955

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without sanitization or encoding. This occurs within the CallbackHandl...

ROS-20260922-73-0087

The vulnerability in Tomcat is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260922-73-0088

The vulnerability in Tomcat10 is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerabilities of the components of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allow attackers to gain unauthorized access to protected information.

The vulnerability of the components of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...

The vulnerability of the os and dns modules in the vm2 package manager NPM allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the os and dns modules in the vm2 package manager NPM is related to errors in information processing. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libxml2 (UTSA-2025-002241)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002241 advisory. An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors...

CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

ROS-20260922-73-0041

The vulnerability of the tlspushrecord function in the net/tls/tlssw.c module of the Linux operating system’s TLS implementation is related to a single-shift error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protect...