EUVD-2026-111387

russh's SSH agent server is susceptible to unbound allocations via repeated SSHAGENTCONSTRAINCONFIRM messages...

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

Summary All evidence, reproduction steps, and scripts in the report were verified against a real running instance. Nothing is fabricated or synthetic; every verdict is backed by captured output from an actual deployment. Concretely, the evidence comes from executing the real russh v0.64.1 client...

CVE-2026-61854 VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In reportbuffer.py, maybecleanup uses an unlocked dictionary for once-per-hour cleanup...

CVE-2026-61854

The VoiceSentinel real-time voice moderation system (versions 2.2.1 to 3.3.1 ) is vulnerable to a race condition in its optional report buffer feature. The root cause is located in report_buffer.py, where _maybe_cleanup() uses an unlocked dictionary for cleanup throttling, allowing simultaneous _...

CVE-2026-61854 VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In reportbuffer.py, maybecleanup uses an unlocked dictionary for once-per-hour cleanup...

Low: ecs-service-connect-agent

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

Linux Distros Unpatched Vulnerability : CVE-2026-119134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not...

Moderate: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

CVE-2026-119134

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119134

The Wasmtime runtime is vulnerable to unbounded host memory growth in versions before 36.0.18 , 37.0.0 before 48.0.6 , and 49.0.0 before 49.0.3 . The root cause is that the runtime caps component-model resource handle tables only per component instance without charging handle allocations to any R...

CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

EUVD-2026-113201

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119134: bytecodealliance wasmtime: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables…

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

PT-2026-132365

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119286: graphql-python graphql-core: GraphQL-core is a Python port of the GraphQL.js reference implementation

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate reuses a module-level ValidationAbortedError when a document exceeds maxerrors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validatio...

PT-2026-132854

Name of the Vulnerable Software and Affected Versions GraphQL-core versions 3.3.0a3 through 3.3.0 Description The validate function reuses a module-level ValidationAbortedError when a document exceeds the max errors threshold. Because Python appends frames to the reused exception's traceback duri...

AlmaLinux 8 : pki-deps:10.6 (ALSA-2026:90909)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:90909 advisory. com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing...