Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to unbounded next-action-time search in the schedule spec evaluation logic in service/worker/scheduler/spec.go and the scheduler/frontend list-matching-time paths. An authenticated caller with...

io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)

A flaw was found in the netty-codec-compression component of Netty. This vulnerability, caused by a logic error in the bzip2 decoder, allows a remote attacker to send specially crafted bzip2-compressed data. Processing this malformed data can trigger an infinite loop, causing the decoder thread t...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

CVE-2026-58270: Inefficient Regular Expression Complexity

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

SUSE SLES12 Security Update : wget (SUSE-SU-2026:4074-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4074-1 advisory. This update for wget fixes the following issue: - CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Tenable has...

SUSE SLED15 / SLES15 Security Update : python-tornado6 (SUSE-SU-2026:4076-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4076-1 advisory. This update for python-tornado6 fixes the following issue - CVE-2026-82397: an unauthenticated request body containing...

Linux Distros Unpatched Vulnerability : CVE-2026-93749

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values...

The vulnerability of the _libssh2_packet_add() function in the src/packet.c component of the SSH2 implementation library Libssh2 allows a attacker to cause a service failure.

The vulnerability of the libssh2packetadd function in the src/packet.c component of the SSH2 protocol implementation library Libssh2 involves executing a loop with an unreachable exit condition. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2026:4073-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4073-1 advisory. This update for python-tornado fixes the following issue: - CVE-2026-82397: an unauthenticated request body containing...

Linux Distros Unpatched Vulnerability : CVE-2026-93560

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integ...

SUSE SLED15 / SLES15 Security Update : wget (SUSE-SU-2026:4049-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4049-1 advisory. This update for wget fixes the following issue: - CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE...

OESA-2026-3973 python-tornado security update

Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fixes: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape....

OESA-2026-3972 python-tornado security update

Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fixes: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape....

OESA-2026-3971 python-tornado security update

Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fixes: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape....

OESA-2026-3960 xmlrpc-c security update

XML-RPC is a quick-and-easy way to make procedure calls over the Internet. It converts the procedure call into an XML document, sends it to a remote server using HTTP, and gets back the response as XML. Security Fixes: libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop...

OESA-2026-3958 xmlrpc-c security update

XML-RPC is a quick-and-easy way to make procedure calls over the Internet. It converts the procedure call into an XML document, sends it to a remote server using HTTP, and gets back the response as XML. Security Fixes: libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop...

OESA-2026-3959 xmlrpc-c security update

XML-RPC is a quick-and-easy way to make procedure calls over the Internet. It converts the procedure call into an XML document, sends it to a remote server using HTTP, and gets back the response as XML. Security Fixes: libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop...

OESA-2026-3957 xmlrpc-c security update

XML-RPC is a quick-and-easy way to make procedure calls over the Internet. It converts the procedure call into an XML document, sends it to a remote server using HTTP, and gets back the response as XML. Security Fixes: libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop...

OESA-2026-3910 wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: GNU wget is...

EUVD-2026-83662

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...