CVE-2026-106069

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as "0127.0.0.1". "tls.checkServerIdentity" normalizes the host...

SUSE SLED15 / SLES15 Security Update : tiff (SUSE-SU-2026:4845-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4845-1 advisory. This update for tiff fixes the following issue: - CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation ...

perl-DBI:1.641 security update

perl-DBI 1.641-11 - CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting read during numeric type casting Resolves: RHEL-271961 1.641-10 - Fix number of tests Resolves: RHEL-247869 1.641-9 - Fix placeholder limit on :N and :pN style placeholders...

CVE-2026-114654

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

EUVD-2026-108328

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

CVE-2026-114654

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

RLSA-2026:85916 Important: perl-DBI:1.641 security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: perl-DBI: perl-DBI: Denial of...

perl-DBI:1.641 security update

An update is available for perl-DBI, module.perl-DBI. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The perl-DBI package provides the standard database interfa...

PT-2026-121525

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

AlmaLinux 8 : perl-DBI:1.641 (ALSA-2026:85916)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:85916 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description block...

Pascal Buchbinder mod_qos numerical error vulnerability

Versions 11.74, 11.76, and 11.79 of Pascal Buchbinder’s modqos contain a numeric error vulnerability. This vulnerability arises from an off-by-one pointer calculation when merging request body parameters with existing URL query parameters. As a result, the query string is truncated during securit...

MongoDB C Driver numeric error vulnerability

Versions prior to MongoDB C Driver 1.30.14 and 2.5.7 contain a numeric error vulnerability. This vulnerability stems from a 32-bit integer wrap-around in Windows-specific Kerberos/SSPI authentication code. When excessively long credential values are provided in client connection configurations, a...

MongoDB C# Driver numeric error vulnerability

A numeric error vulnerability exists in MongoDB C Driver versions 2.0.0 through 3.13.0. This vulnerability stems from a flaw in the BSON processing library regarding numerical type conversion. Untrusted text inputs containing boundary values for binary subtype types can bypass integrity checks on...

Rocky Linux 8 [CIQ] Security Update: perl-DBI / perl-DBI-debuginfo / perl-DBI-debugsource (crlsa-2026_85916)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685916 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description block...

CVE-2026-114144

A flaw was found in toml-node. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted TOML document containing excessively long numeric sequences. When parsing these unbounded values, the application consumes excessive CPU resources and blocks the main execution...

Security update for tiff

This update for tiff fixes the following issue: CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough bsc1280164. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4845-1 Security update for tiff

This update for tiff fixes the following issue: - CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough bsc1280164...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via improper handling of non-finite numeric values

A flaw was found in kin-openapi. A remote, unauthenticated attacker can exploit this vulnerability by submitting a specially crafted YAML request containing non-finite numeric values, such as Not-a-Number or infinity, to an endpoint with numeric constraints. Because the validation process fails t...

Security update for libraw

This update for libraw fixes the following issue: CVE-2026-88387: incorrect numeric conversion in LibRaw::parsetiffifd when processing TIFF tag 0x00fe can lead to undefined behavior and a process crash when a specially crafted file is processed bsc1282783. Patch Instructions: To install this SUSE...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service DoS by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields from JSON strings,...