PT-2026-135022

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution RCE when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh...

PT-2026-121278

Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. count min sketch::deserialize did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In...

Bytecode Alliance wasmtime resource management error vulnerability

Bytecode Alliance versions prior to 36.0.16, 37.0.0 through 48.0.3, and 49.0.0 through 49.0.1 contain a resource management error vulnerability. This vulnerability stems from waSTM time-wasi-http failing to enforce a write check limit on the WASIp2 outbound HTTP body, thereby allowing excessively...

PT-2026-121291

A flaw was found in mod qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an...

PHP 5.6.40 PHP2Shell Backport

PHP version 5.6.40 source-level backport addresses out-of-memory corruption and stale global state associated with the PHP2Shell vulnerabilities...

PHP 8.5.11 Remote Code Execution

PHP versions through 8.5.11 contain out-of-memory corruption and stale global-state flaws that can result in unauthenticated remote code execution when processing web requests...

PHP 7.3.33 Remote Code Execution Backports

PHP versions 5.4.45 through 7.3.33 contain out-of-memory corruption and stale global state vulnerabilities that may allow remote code execution. Supplied source patches backport mitigations...

PHP 8.5.11 php2shell Patch-Level Verification Tool

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory handling flaw that can lead to remote code execution. This tool performs host-side patch and configuration checks, or non-destructive external header reconnaissance...

PT-2026-121659

Name of the Vulnerable Software and Affected Versions aws-c-mqtt versions prior to 0.16.2 Description The MQTT 3.1.1 compatibility adapter contains a flaw where memory allocation occurs with an excessive size value. This could allow a remote actor to cause a denial of service of the client...

PT-2026-121566

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A malicious guest can pass large buffers to write on...

PT-2026-121631

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A memory corruption issue exists that allows an authenticated local attacker to execute arbitrary code. Successful exploitation enables the attacker to run arbitrary code with privileged user...

PT-2026-121569

Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causi...

Bytecode Alliance wasmtime resource management error vulnerability

Bytecode Alliance: Versions prior to 36.0.17, versions 37.0.0 through 48.0.4, and versions 49.0.0 through 49.0.2 contain a resource management error vulnerability. This vulnerability stems from unbounded memory allocation in the write-zeroes method within SinkOutputStream of wasmtime-wasi WASIp2....

MongoDB Server 8.2.2 Zlib Memory Disclosure

MongoDB Server versions through 8.2.2 contain an unauthenticated memory disclosure issue caused by mismatched lengths in zlib-compressed protocol headers. The proof of concept sends malformed compressed messages and extracts returned heap fragments. https://packetstorm.news/download/237022...

HPE ArubaOS security vulnerabilities

HPE ArubaOS 8 has a security vulnerability stemming from a memory corruption issue. This allows authenticated local attackers to execute arbitrary code, potentially enabling them to run arbitrary code with privileged privileges on the underlying operating system...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a memory corruption flaw in affected interfaces. Unauthenticated neighboring attackers can exploit this vulnerability to achieve remote code execution. Successful exploitation allows them to execute arbitrary code with privileged...

PT-2026-121515

The MongoDB C Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no...

RHEL 9 : libkcapi (RHSA-2026:87712)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87712 advisory. libkcapi allows user-space to access the Linux kernel crypto API. This library uses the netlink interface and exports easy to use APIs so...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143063 advisory. In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error is encountered while mapping TX buffers, the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143043)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143043 advisory. Due to a vulnerability in the iouring subsystem, it is possible to leak kernel memory information to the user process.timensinstall calls currentissinglethreaded to...