AlmaLinux 9.6 [TuxCare] Security Update: libpng15 (ALMALINUX9.6:CLSA-2026:1785493623)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785493623 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files...

Rocky Linux 9.6 [TuxCare] Security Update: libpng / libpng-devel / libpng-static / libpng-tools (ALMALINUX9.6:CLSA-2025:1765380269)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765380269 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files...

CVE-2026-96675

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failur...

SUSE CVE-2026-93989

vLLM through 0.29.0 fails to properly validate badwords token indices against the model's generation output width in SamplingParams.updatefromtokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to...

PT-2026-102786

vLLM through 0.29.0 fails to properly validate bad words token indices against the model's generation output width in SamplingParams.update from tokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests...

CVE-2026-93989: Improper Validation of Array Index

vLLM through 0.29.0 fails to properly validate badwords token indices against the model's generation output width in SamplingParams.updatefromtokenizer. Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to...

PT-2026-95873

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description The software fails to properly validate bad words token indices against the model's generation output width within the SamplingParams.update from tokenizer function. This allows attackers to provide...

GHSA-9RGM-9G3H-6X36 Svelte devalue: DoS via malformed input

Impact devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size. Applications are potentially affected if the...

Svelte devalue: DoS via malformed input

Impact devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size. Applications are potentially affected if the...

EUVD-2026-80943

Svelte devalue: DoS via malformed input...

CVE-2026-81176

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...

CVE-2026-81176 Svelte devalue: DoS via malformed input

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...

PT-2026-93901

Name of the Vulnerable Software and Affected Versions Svelte devalue versions prior to 5.9.2 Description Svelte devalue is a JavaScript library used to serialize values into strings. The devalue.parse function in src/parse.js fails to reject out-of-bounds indices that are greater than or equal to...

CVE-2026-81176: Allocation of Resources Without Limits or Throttling

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fixed potential OOB access in audio mixer handling. In the audio mixer handling code of the ctxfi driver, the conf field is used as a loop index, and it’s referenced in the index callback functions amixerindex and...

Astra Linux – Vulnerability in libpng1.6

LIBPNG is a reference library used in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior to version 1.6.51, there was a heap buffer over-read vulnerability in the libpng’s pngdoquantize function when processing PNG files with malformed palette...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder did not validate the pixel index value returned by GetPixelIndex before using it as an array subscript. In HDRI builds, Quantum is...

EUVD-2026-42936

Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation...

CVE-2026-78601

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...

CVE-2026-78601 Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...