CVE-2026-55731

Loytec LINX firmware (LINX-A64) versions up to 8.4.16 are affected by an unchecked input for loop condition (CWE-606) in the SNMP agent. The issue allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) by sending a crafted SNMP GETNEXT request with a larg...

CVE-2026-55731 Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...

EUVD-2026-48596

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...

OESA-2026-3184 coredns security update

CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in...

Security Bulletin: IBM DevOps Loop has multiple vulnerabilities

Summary IBM DevOps Loop v2.0.2 addresses multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties auth, baseURL, socketPath,...

OPENSUSE-SU-2026:21441-1 Security update for distribution

This update for distribution fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266629. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...

PT-2026-67608

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

PT-2026-64345

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tps65219 regulator driver where the irq data.rdev variable remains uninitialized for all Interrupt Requests IRQs. This occurs because a previous removal of the...

PT-2026-71720

Name of the Vulnerable Software and Affected Versions js-yaml versions 5.0.0 through 5.2.1 Description Parsing a small YAML document can lead to exponential time consumption when an application calls the load or loadAll functions on untrusted input. In the src/parser/parser.ts file, the...

Security update for helm (important)

openSUSE security update: security update for helm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21422-1 Rating: important References: bsc1266598 bsc1271997 Cross-References: CVE-2026-39821 CVE-2026-56852 CVSS scores: CVE-2026-39821 SUSE : 7.4...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21395-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21395-1 advisory. This update for trivy fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels...

ImageMagick DoS

The vulnerability of the console-based graphic editor ImageMagick is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-65699

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target runid in the request body without ownership verification. The AgentCRUD.createtask and...

GHSA-G867-7843-WF8Q pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters. Patches This...

EUVD-2026-42365

pypdf: Possible infinite loop for not terminated inline images ASCII85 and ASCIIHex filter...

GHSA-5XF7-4P34-54QR pypdf: Possible infinite loop for not terminated inline images

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. Patches This has been fixed in pypdf==6.14.1. Workarounds If yo...

EUVD-2026-42366

pypdf: Possible infinite loop for not terminated inline images...

pypdf: Possible infinite loop for not terminated inline images

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. Patches This has been fixed in pypdf==6.14.1. Workarounds If yo...

GHSA-XH5M-36R6-47M3 PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection,...

Infinite loop

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Infinite loop through the read function. An attacker can cause the application to exhaust system memory and crash by submitting ...