GO-2026-6325 Grafana Tempo vulnerable to an out-of-memory crash in github.com/grafana/tempo

Grafana Tempo vulnerable to an out-of-memory crash in github.com/grafana/tempo...

Astra Linux – Vulnerability in Firefox

A maliciously crafted favicon could lead to a memory-out-of-control crash. This vulnerability affects Firefox versions earlier than 113...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. Spaces used in a string surrounding a domain name can, when ignored, cause invalid DN strings to write a zero-byte into out-of-bounds memory, resulting in a crash. The greatest threat of this vulnerability is to system availability...

SUSE CVE-2026-73089

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct queries, context result in cache and every parseQueries AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who...

PT-2026-70418

Name of the Vulnerable Software and Affected Versions Microsoft Remote Registry Service affected versions not specified Description A null pointer dereference in the Microsoft Remote Registry Service allows an authorized attacker to cause a denial of service over a network. A null pointer...

CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-71314 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAXVFORLENGTH = 100000 and crash the Nuxt process. This iss...

gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using reskippascalstring without validating that offsets remain...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

CVE-2026-58216

CVE-2026-58216 : An out-of-bounds read (heap OOB) vulnerability in Samba’s Kerberos KDC kpasswd service when parsing malformed ASN.1 password-change requests can read up to six bytes beyond the allocated buffer. An authenticated attacker could cause the KDC to crash, triggering denial of service....

CVE-2026-58184

The Apache Traffic Server headerrewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version...

Linux Distros Unpatched Vulnerability : CVE-2026-58184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Traffic Server headerrewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traff...

PT-2026-65634

Summary Using Databasecreate function or Databasedefine function to define the same function name more than once with different numbers of arguments "arity" or text encodings will result in a invalid memory read and a segmentation fault. Mitigation Upgrade to sqlite3 gem v2.9.5 or later. As a...

kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio subsystem. An inconsistency in how USB audio playback and capture streams are handled can lead to an out-of-bounds write to a memory buffer. This can result in a system crash, causing a denial of service for a...

swift-crypto: swift-crypto: Denial of Service due to double-free during RSA public key initialization

A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...

NPM: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

NPM: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.17...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

CVE-2026-43823

The CVE describes a double-free in EVP_PKEY* when initializing an RSA public key from DER/PEM bytes if decoding fails. The double-free occurs first in the catch block and again in deinit, potentially causing a crash on subsequent memory allocations. Affected code path manifests when BoringSSL can...

CVE-2026-9499 Out-of-bounds read in QTextCodec::codecForName() in Qt

An out-of-bounds read buffer over-read vulnerability exists in QTextCodec::codecForName in Qt. When the function is called with a QByteArray that is not NUL-terminated for example, one created with QByteArray::fromRawData, the codec-name matching routine reads past the end of the supplied buffer...