GHSA-W7JP-MF2V-8342 Vikunja: Denial of service via decompression bomb in the data import

Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archive expands to, how many files it contains, or how much storage one user can consume, and it appears to hold the whole archive in memory while processing it. Because the archive is...

GHSA-4VH2-39RQ-RQ8J Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

CVE-2026-108106

A flaw was found in snappy-java. A remote attacker can exploit this unbounded memory allocation vulnerability by providing crafted compressed input with an excessively large declared uncompressed size during decompression. Successful exploitation allows the attacker to exhaust available system...

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...

GHSA-6R69-C6WG-7G8M yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...

CVE-2026-107821

A flaw was found in MariaDB. An attacker able to place a crafted table format FRM metadata file into the database data directory can exploit insufficient validation of metadata boundaries and field counts when the server opens the file. This could lead to out-of-bounds memory operations,...

poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption

A flaw was found in Poppler. A stack-based buffer overflow vulnerability exists in the decryption routine when processing encrypted PDF documents. By providing an overly long password during document decryption, an attacker can overwrite memory buffers. This issue primarily leads to a Denial of...

CVE-2026-107839

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the...

CVE-2026-107840

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107836

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoapsockgetslice in sys/net/applicationlayer/nanocoap/sock.c accepts a Block2 response when blockcb sees the expecte...

CVE-2026-107837

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, receive in sys/net/gnrc/networklayer/sixlowpan/gnrcsixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload...

CVE-2026-107816

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qcinfo plugin could be confused by a query containing embedded null bytes. Reading informationschema.querycacheinfo after such a query was cached could acces...

CVE-2026-107816

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qcinfo plugin could be confused by a query containing embedded null bytes. Reading informationschema.querycacheinfo after such a query was cached could acces...

CVE-2026-107840

The yopass secret-sharing service is vulnerable to a memory exhaustion attack in versions prior to 14.7.0 . The root cause lies in the Prometheus metrics middleware within pkg/server/server.go, which uses the attacker-controlled r.Method value as a label for yopass_http_requests_total and yopass_...

CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

EUVD-2026-95935

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107839

The ageLANServer software, which provides a cross-platform web server and launcher for Age of Empires and Age of Mythology games, is vulnerable to a Remote Denial of Service (DoS) . In versions prior to 1.15.2 , the AoE3 POST /game/cloud/getFileURL handler lacks a request body size limit and fail...