Pillow: Decompression-bomb Protection Bypass Via Multi-frame Seek() In MPO And DCX (MpoImageFile.seek / DcxImageFile.see

Summary Pillow's decompression-bomb protection "Image.decompressionbombcheck", gated by "Image.MAXIMAGEPIXELS" is enforced only on the first frame, inside "Image.open". For multi-frame formats, "seek" re-parses the target frame's header and resets "self.size". "GifImagePlugin" and "TiffImagePlugi...

Pillow: BMP RLE Decoder Memory-amplification DoS Via Unbounded Delta Escape / Absolute Mode

Summary BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. Affected versions All versions up to and including current HEAD v13.0.0.dev0, commit e7a7ea84 Root cause...

CVE-2026-98766

A flaw was found in the Linux kernel's Aspeed virtual hub vhub driver. When a device is removed, scheduled wakeup tasks are not properly canceled, allowing background work to run after the associated memory structures have been freed. A local attacker could exploit this race condition to trigger ...

CVE-2026-98760

A flaw was found in the Linux kernel's TPS6598x USB Type-C driver. When a partner device connects, the driver fails to properly initialize temporary memory structures allocated on the stack before registering the connection. An attacker connecting a USB Type-C device could exploit this flaw to...

CVE-2026-98759

A flaw was found in the Linux kernel's USB Type-C TI Power Delivery tipd driver. The driver fails to initialize memory for descriptor structures when handling partner device connections. An attacker connecting a USB device can cause the system to invoke uninitialized function pointers, leading to...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109618 / CVE-2026-109619 PHP2Shell RCE ★ CVE-2026-10...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2SHELL — engine-level RCE on PHP 8.4.26 modphp Research l...

CVE-2026-98757

A flaw was found in the Linux kernel's Cadence USB3 gadget driver. This vulnerability can lead to a Denial of Service DoS through a system crash or potentially allow privilege escalation. During device teardown, the driver releases memory without waiting for pending background work tasks to finis...

CVE-2026-98755

A flaw was found in the Linux kernel's Virtual Console Concentrator VCC driver. When sending control messages across a Logical Domain Channel LDC, the driver transmits packets without completely clearing the allocated memory buffer first. A connected peer can inspect these messages to access...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

🔬 PHP2Shell — Research & Exploitation Toolkit v2.2.0 !CA...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell - Official environment, no displayerrors needed,...

CVE-2026-98752

A flaw was found in the Linux kernel's TTY terminal subsystem. This vulnerability allows a local user to cause a Denial of Service DoS or potentially execute arbitrary code. A race condition during port disconnect and hangup routines allows the kernel to release resources while they are still bei...

jose: jose: Denial of Service via unbounded decompression of crafted JWE tokens

A flaw was found in jose. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS through memory exhaustion. When processing JSON Web Encryption JWE tokens that use compression, the library decompresses the payload without enforcing limits on the output size ...

Chromium CVE-2026-113291: Memory corruption

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

jose: jose: Denial of Service via unbounded decompression of crafted JWE tokens

A flaw was found in jose. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS through memory exhaustion. When processing JSON Web Encryption JWE tokens that use compression, the library decompresses the payload without enforcing limits on the output size ...

Chromium CVE-2026-113288: Memory corruption

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-113286: Memory corruption

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-113285: Memory corruption

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-113284: Memory corruption

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-113283: Memory corruption

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...