PT-2026-102489

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.8 Wireshark versions 4.4.0 through 4.4.18 Description A flaw in the TIFF protocol dissector can lead to an infinite loop, resulting in a denial of service. Recommendations Update Wireshark versions 4.6.0...

PT-2026-102477

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.8 Description A flaw in the TTL file parser can lead to an infinite loop, resulting in a denial of service. Recommendations Update to version 4.6.9...

Important: libpcap

Issue Overview: In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the...

DEBIAN-CVE-2026-100700

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

CVE-2026-100700

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

UBUNTU-CVE-2026-100700

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

CVE-2026-100700 nodemailer before 10.0.6 Denial of Service via addressparser

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

CVE-2026-100700 nodemailer before 10.0.6 Denial of Service via addressparser

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

CLEANSTART-2026-NW24142 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CVE-2026-100700: Inefficient Algorithmic Complexity

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

Linux Distros Unpatched Vulnerability : CVE-2026-100700

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking...

openSUSE 16 Security Update : python-asyncssh (openSUSE-SU-2026:21953-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21953-1 advisory. Changes in python-asyncssh: - CVE-2026-62949: denial of service via infinite loop when processing zero-sized SSH packets bsc1280972 Tenable has extracte...

openSUSE 16 Security Update : libpcap (openSUSE-SU-2026:21940-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21940-1 advisory. - CVE-2026-0799: the BPF interpreter does not validate values in BPF instructions that load/store a value from/to a scratch memory register and...

SUSE CVE-2026-98155

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift:...

Security Bulletin: The Pre-Validation App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Pre-Validation App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-33750 DESCRIPTION: The...

BIT-RCLONE-2026-79775 rclone Archive Backend SquashFS Parser Denial of Service

rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...

DEBIAN-CVE-2026-98009

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-97981

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

DEBIAN-CVE-2026-97900

In the Linux kernel, the following vulnerability has been resolved: drm/drmexec: fix up contended obj when numobjects is 0 drmexecpreparearray silently returns success without calling drmexeclockcontended when numobjects is zero. This breaks the invariant upheld by drmexeclockobj, where every ent...