CVE-2026-33524 Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error Denial of Service. This vulnerability is fixed in...

CVE-2026-21728

CVE-2026-21728 affects Grafana Tempo: queries with large limits can trigger large memory allocations, potentially impacting service availability depending on deployment. Technical detail across sources confirms the issue arises from unbounded or excessive memory usage during large-limit tempo que...

Grafana Tempo 资源管理错误漏洞

Grafana Tempo is a distributed tracing data storage and querying system developed by Grafana in open source. Grafana Tempo has a resource management vulnerability, which stems from excessive query restrictions leading to excessive memory allocation, potentially affecting the availability of the...

CVE-2026-31471

A flaw was found in the Linux kernel, specifically within the xfrm: iptfs component. This vulnerability arises during the cloning of network security states, where an error in memory allocation can lead to the system attempting to use or free memory that has already been released. This memory...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007571)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007571 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible UAF when remounting r/o a mmp-protected file system After commit 618f003199c6...

The vulnerability of the UPnP Device Host operating system in Windows allows a hacker to execute arbitrary code.

The vulnerability of the UPnP Device Host operating system in Windows relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-34757

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from pnggetPLTE, pnggettRNS, or pnggethIST back into the corresponding setter on the same...

CVE-2026-35480

go-ipld-prime is an implementation of the InterPlanetary Linked Data IPLD spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers a...

The vulnerability of the type, atype, and flags attributes in the Libxslt XML analysis library allows a attacker to execute arbitrary code.

The vulnerability of the type, atype, and flags attributes of the Libxslt XML parsing library is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Security update for docker-stable

This update for docker-stable fixes the following issues: CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption bsc1253904. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupda...

CVE-2026-33219: Allocation of Resources Without Limits or Throttling

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a...

samtools 资源管理错误漏洞

Samtools is an open-source toolkit for processing high-throughput sequencing data. Versions of Samtools prior to 1.21.1 and 1.22 contain a resource management vulnerability. This vulnerability stems from the mpileup command prematurely discarding data, which may lead to the reading of memory that...

Google Chrome WebMCP Resource Management Error Vulnerability

Google Chrome is a free web browser developed by Google Inc. A security vulnerability exists in Google Chrome WebMCP, which originates from re-referencing or using freed memory, and can be exploited by remote attackers to execute arbitrary code...

UBUNTU-CVE-2026-28687

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerabilit...

openSUSE 16 Security Update : containerized-data-importer (openSUSE-SU-2026:20279-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20279-1 advisory. Update to version 1.64.0. Security issues fixed: - CVE-2024-28180: improper handling of highly compressed data bsc1235204. - CVE-2024-45338:...

SUSE-SU-2026:0772-1 Security update for docker

This update for docker fixes the following issues: - CVE-2025-58181: Fixed a bug in crypto/ssh where invalidated number of mechanisms can cause unbounded memory consumption. bsc1253904...

CVE-2026-27710

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a denial-of-service vulnerability exists in NanaZip’s .NET Single File Application parser. A crafted bundle can force an integer underflow in header-size calculation and trigger...

SUSE CVE-2026-27025

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text...

urllib3: urllib3 Streaming API improperly handles highly compressed data

A decompression handling flaw has been discovered in urllib3. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header e.g., gzip, deflate, br, or zstd. The library must read compressed data from the network and decompress it...

EulerOS 2.0 SP13 : grub2 (EulerOS-SA-2026-1210)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability has been identified in the GRUB Grand Unified Bootloader component. This flaw occurs because the bootloader mishandles string...