CVE-2026-44577 Next.js: Denial of Service in the Image Optimization API

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could...

Malicious Package

Overview github.com/BufferZoneCorp/config-loader is a malicious package. This package contains malicious code designed to compromise developer systems and CI environments, specifically targeting GitHub Actions. The threat actor, operating under the GitHub account BufferZoneCorp, published a clust...

SUSE CVE-2026-44777

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other...

Malicious code in github.com/BufferZoneCorp/config-loader (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

MAL-2026-3620 Malicious code in github.com/BufferZoneCorp/config-loader (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

Cisco IOS XE Loader Code Execution

The vulnerability of the Cisco IOS XE operating system loader is related to a violation of the initial buffer boundary. Exploiting this vulnerability allows an attacker to execute arbitrary code...

gimp: GIMP:Memory disclosure and denial of service via specially crafted PCX image

A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible...

co.paralleluniverse:comsat-tomcat-loader (0.1.0), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.0-rc3) potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.0.0-rc3)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - co.paralleluniverse:comsat-tomcat-loader 0.1.0 -...

co.paralleluniverse:comsat-tomcat-loader (0.1.1), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.3) +1 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.0.3)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - co.paralleluniverse:comsat-tomcat-loader 0.1.1 -...

co.paralleluniverse:comsat-tomcat-loader (0.1.0), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.0-rc3) potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.0.0-rc3)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - co.paralleluniverse:comsat-tomcat-loader 0.1.0 -...

co.paralleluniverse:comsat-tomcat-loader (0.1.1), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.3) +1 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.0.3)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - co.paralleluniverse:comsat-tomcat-loader 0.1.1 -...

co.paralleluniverse:comsat-tomcat-loader (0.1.0), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.0-rc3) potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.0.0-rc3)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - co.paralleluniverse:comsat-tomcat-loader 0.1.0 -...

co.paralleluniverse:comsat-tomcat-loader (0.1.1), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.3) +1 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.0.3)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - co.paralleluniverse:comsat-tomcat-loader 0.1.1 -...

co.paralleluniverse:comsat-tomcat-loader (0.1.1), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.3) +1 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.0.3)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - co.paralleluniverse:comsat-tomcat-loader 0.1.1 -...

co.paralleluniverse:comsat-tomcat-loader (0.1.0), org.apache.tomcat.embed:tomcat-embed-jasper (8.0.0-rc3) potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.0.0-rc3)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - co.paralleluniverse:comsat-tomcat-loader 0.1.0 -...

com.github.dblock.waffle:waffle-tomcat8 (1.7.5), com.intersult:maven-loader (>=1.2, <=1.3) +11 more potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat-catalina (8.0.28)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.28 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.github.dblock.waffle:waffle-tomcat8 1.7.5 - com.intersult:maven-loader =1.2, =16, =16,...

Fake Claude search results lure Mac users into ClickFix attack

Researchers found that cybercriminals are using sponsored search results and shared Claude chats to lure victims into a typical ClickFix attack to install malware on macOS devices. ClickFix is a social engineering method that tricks users into infecting their own device with malware. Users are...

CVE-2026-7482

A flaw was found in Ollama. A remote attacker can exploit a heap out-of-bounds read vulnerability in the GGUF model loader by providing a specially crafted GGUF GGML Unified Format file to the /api/create endpoint. This allows the attacker to read beyond the allocated memory buffer, potentially...

EUVD-2026-29347

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section...

MilanLaunchy Firmware Loader

References CVE-2021-26315: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1021.html CVE-2024-21944: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3015.html CVE-2024-21981: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html &...