CVE-2026-91987: Allocation of Resources Without Limits or Throttling

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

Astra Linux – Vulnerability in SQLite3

There is a vulnerability in SQLite versions before 3.50.2, where the number of aggregate terms can exceed the number of available columns. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or higher...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix for out-of-bound access issues. If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSAMAXPORTS the size of the mv88e6xxxchip.ports array...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mlxsw: Thermal: Fix out-of-bounds memory accesses Currently, mlxsw allows cooling states to be set above the maximum cooling state supported by the driver: bash cat /sys/class/thermal/thermalzone2/cdev0/type mlxswfan cat...

btrfs: reject free space cache with more entries than pages

...

CVE-2026-64567 btrfs: reject free space cache with more entries than pages

In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, loadfreespacecache takes numentries and numbitmaps straight from the on-disk btrfsfreespaceheader. That header is stored in the...

CVE-2026-42169

CVE-2026-42169 affects GIMP and its DDS plug-in. The APNG loader has a heap-buffer-overflow when fcTL width exceeds IHDR width, causing writes past heap bounds. A second heap-based overflow in the DDS plug-in arises from a BPP mismatch in load_layer(). Both issues are triggered by opening a speci...

netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec

A flaw was found in Netty. A remote attacker can exploit a vulnerability in the SpdyHttpDecoder handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated SYNSTREAM frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This...

ROS-20260724-73-0034

The vulnerability in ImageMagick relates to the target surface whose quantitative dimensions exceed the desired maximum. Exploiting this vulnerability can allow an attacker to compromise the confidentiality of the protected information...

CVE-2026-64159

A flaw was found in the Linux kernel's network file system netfs component. This vulnerability occurs when the local file size is larger than the size reported by the remote server, leading to an incorrect update of the 'zero point' a file position used to optimize reads. An attacker could...

CVE-2026-62208

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's...

Tensorflow vulnerable to Out-of-Bounds Read

ImpactWhen the BaseCandidateSamplerOp function receives a value in trueclasses larger than rangemax, a heap oob vuln occurs.pythontf.rawops.ThreadUnsafeUnigramCandidateSampler trueclasses=0x100000,1, numtrue = 2, numsampled = 2, unique = False, rangemax = 2, seed = 2, seed2 = 2 PatchesWe have...

PT-2026-59757

Impact When the BaseCandidateSamplerOp function receives a value in true classes larger than range max, a heap oob vuln occurs. python tf.raw ops.ThreadUnsafeUnigramCandidateSampler true classes=0x100000,1, num true = 2, num sampled = 2, unique = False, range max = 2, seed = 2, seed2 = 2 Patches ...

EUVD-2026-42147

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a...

Connection confusion in gRPC

When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this...

EUVD-2026-41929

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value...

CVE-2026-21379

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value...

PT-2026-55991

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when the system attempts to allocate memory with sizes that exceed the maximum allowed value. Recommendations At the moment, there is no...

TencentOS Server 2: sqlite (TSSA-2025:1024)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1024 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-53208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2capcore.c:l2capsigchannel accepts BR/EDR signaling packets up to the channel MTU a...