PT-2026-83055

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker with valid credentials can cause CPU consumption and subsequent service degradation or denial of service for IMAP by using the IMAP LIST command. Recommendations Update to version...

CVE-2026-38636

A Denial of Service vulnerability exists in the seekdir() function within /dirent/mod.rs of relibc (Redox OS's standard C library), specifically at commit 61f42d. A remote attacker can trigger a DoS by supplying a crafted input, with no privileges or user interaction required (CVSS 7.5 HIGH , vec...

PT-2026-83369

Name of the Vulnerable Software and Affected Versions free5GC versions 1.4.4 and earlier Description The AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool within internal/context/context.go, using only the SUPI as a key. Requests processed by...

PT-2026-83059

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker can send a crafted email with message header values designed to collide in an internal hash table. This causes the IMAP THREAD command to consume CPU resources disproportionate to the...

The vulnerability in the io_uring/kbuf.c component of the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability in the iouring/kbuf.c component of the Linux operating system’s kernel is related to insufficient checking of the status of the shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2026-67770

An issue in the seekdir function /dirent/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-82877

Name of the Vulnerable Software and Affected Versions Synology Chat Server versions prior to 2.4.5-22148 Description An improper neutralization of input during web page generation, known as Cross-site Scripting XSS, occurs in the extract domain component. This allows remote authenticated users,...

CVE-2026-37237

vLLM (versions up to and including 0.17.0 ) is vulnerable to a Denial of Service via memory exhaustion . The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without enforcing a maximum response ...

CVE-2026-40015

An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause...

CVE-2026-27852

An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit...

CVE-2026-40013

An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...

UBUNTU-CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

UBUNTU-CVE-2026-33263

When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input. The vulnerability is rated CVSS 3.1: 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning it is network-exploitable with n...

The vulnerability of the Backup component in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, allows a hacker to trigger a service failure.

The vulnerability of the Backup component in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, is related to a lack of data security mechanisms. Exploiting this vulnerability could allow an attacker to cause service interruptions...

The vulnerability of the icmp_build_probe() function in the net/ipv4/icmp.c module of the Linux operating system allows a hacker to induce a service failure.

The vulnerability of the icmpbuildprobe function in the net/ipv4/icmp.c module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the lib/nghttp2_session.c component, part of the HTTP/2 implementation by Nghttp2, allows a attacker to cause a service failure.

The vulnerability of the lib/nghttp2session.c component in the HTTP/2 implementation of Nghttp2 is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Vulnerability of Firefox web browsers, Firefox ESR, and Thunderbird email client: This vulnerability arises from operations beyond the buffer in memory, allowing attackers to trigger a service failure.

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

UBUNTU-CVE-2026-40013

An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...