PT-2026-71422

Name of the Vulnerable Software and Affected Versions baseline-browser-mapping versions 2.x through 2.10.x Description The software calls process.exit instead of throwing an error when it encounters invalid or conflicting input parameters. This behavior can trigger the immediate termination of th...

CVE-2026-54338 JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

SUSE SLES15 Security Update : google-guest-agent (SUSE-SU-2026:3497-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3497-1 advisory. This update for google-guest-agent fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

Infinite loop on invalid input in golang.org/x/text

...

Linux Distros Unpatched Vulnerability : CVE-2026-56852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Note that Nessus relies on the presence of the package...

ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder...

CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

SUSE CVE-2026-63878

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO kvcallocargs-numentries, sizeofvmentries, GFPKERNEL at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and...

PYSEC-2026-3182 TensorFlow Denial of Service vulnerability

Impact A malicious invalid input crashes a tensorflow model Check Failed and can be used to trigger a denial of service attack. To minimize the bug, we built a simple single-layer TensorFlow model containing a Convolution3DTranspose layer, which works well with expected inputs and can be deployed...

PYSEC-2026-3238 Segfault in `CompositeTensorVariantToComponents`

Impact An input encoded that is not a valid CompositeTensorVariant tensor will trigger a segfault in tf.rawops.CompositeTensorVariantToComponents. python import tensorflow as tf encode = tf.rawops.EmptyTensorListelementdtype=tf.int32, elementshape=10, 15, maxnumelements=2 meta= ""...

CVE-2026-10664

The nRF70 Wi-Fi driver's power-save event handler nrfwifieventprocgetpowersaveinfo in drivers/wifi/nrfwifi/src/wifimgmt.c copied TWT Target Wake Time flow entries from an nrfwifiumaceventpowersaveinfo event into the fixed-size twtflowsWIFIMAXTWTFLOWS 8-element array of a caller-supplied struct...

Realtek Wireless Driver Heap Buffer Overflow DoS

The vulnerability of the dpkpasread function in the drivers/net/wireless/realtek/rtw89/rtw8852arfk.c driver for the Realtek wireless adapter in the Linux operating system is related to insufficient validation of input data during division by zero. Exploiting this vulnerability could allow an...

PYSEC-2026-3223 Undefined behavior in `SparseTensorSliceDataset`

Impact The implementation of SparseTensorSliceDataset has an undefined behavior: under certain condition it can be made to dereference a nullptr value: python import tensorflow as tf import numpy as np tf.rawops.SparseTensorSliceDataset indices=, values=, denseshape=1,1 The 3 input arguments...

h2o vulnerable to unexpected POST request shutting down server

In h2oai/h2o-3 version 3.46.0, the runtool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service...

EUVD-2026-25008

rm: 'rm -rf ./' and ./// variants silently deletes current directory contents, bypassing dot protection...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...