396836 matches found
CVE-2026-48484
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...
linux-explorer
¡Este proyecto ya no recibe mantenimiento! Linux Expl0rer Caja de herramientas de análisis forense en vivo fácil de usar para endpoints Linux, escrita en Python y Flask. Capacidades ps Ver lista completa de procesos Inspeccionar el mapa de memoria del proceso y obtener cadenas de memoria fácilmen...
Updated mingw-pcre2 & pcre2 packages fix security vulnerabilities
PCRE2 before 10.48 allows a pcre2dfamatch out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check even though a newly allocated block, for the same purpose, does have a size check. This outcome requires an attacker-controlled regula...
CVE-2026-98236
A flaw was found in the Linux kernel's MHI MBIM Modem Host Interface Mobile Broadband Interface Model driver. When receiving network data, the driver ignores the return value of memory copy operations when extracting datagrams. A compromised or malicious modem can supply crafted datagram offsets...
CVE-2026-108039
A flaw was found in Apache CXF. By default, the XML parsing utility does not enforce limits on the total number of elements or characters within an incoming XML document. A remote attacker could exploit this vulnerability by sending an excessively large XML request, causing the application to...
CVE-2026-107937
A flaw was found in Apache CXF. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a crafted multipart request containing excessively large or repeated attachment headers. Because the parser fails to properly enforce size and count limits on multi-line and repeated...
CVE-2026-98223
A flaw was found in the Linux kernel's memory management component. When dropbehind memory pages are mapped during read-ahead fault operations, the kernel can mistakenly attempt to execute a sleepable operation while running in an atomic, non-preemptible context upon writeback completion. A local...
CVE-2026-98225
A flaw was found in the Linux kernel's memory management subsystem. A local attacker can trigger kernel warnings and potentially cause a Denial of Service DoS or system instability when kernel memory accounting is disabled. Under this configuration, memory shrinker identifiers are not properly...
CVE-2026-98228
A flaw was found in the Linux kernel's MIPS architecture support for Mobileye EyeQ platforms. On affected systems, atomic operations lack required memory synchronization barriers, which allows the processor to improperly reorder memory access. A local user can exploit this race condition through...
K000163640: Apache Struts vulnerabilities CVE-2026-104711, CVE-2026-104712, CVE-2026-104713, and CVE-2026-104714
Security Advisory Description CVE-2026-104711 Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject...
DEBIAN-CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...
CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...
CVE-2026-104112
A missing release of resources in the illumos name service cache daemon nscd allows a local user to exhaust kernel memory. The nscd door server procedure, switcher in usr/src/cmd/nscd/nscdfrontend.c, does not close file descriptors that are passed with a door call but not used by the request, and...
CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...
Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs
Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-91776 and CVE-2026-91777 Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplie...
CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...
CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...
EUVD-2026-95807
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...
CVE-2026-108106 Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...
CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...