PT-2026-95654

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 7.0.17 Suricata versions prior to 8.0.6 Description The SMB parser can retain force-completed transactions on flows where payload is seen in only one direction, including async-oneside flows, as the cleanup process...

PT-2026-95653

Name of the Vulnerable Software and Affected Versions Suricata versions 8.0.5 through 8.0.5 Description The FTP parser in src/app-layer-ftp.c can continue allocating transactions even after the app-layer.protocols.ftp.max-tx limit is reached when processing a single large chunk of FTP command dat...

PT-2026-95658

Name of the Vulnerable Software and Affected Versions Suricata versions 8.0.0 through 8.0.5 Description The HTTP/1 parser limits decompression work per transaction but fails to limit the number of small brotli compression bombs a single flow can submit. When the response-body-decompress-layer-lim...

PT-2026-95655

Name of the Vulnerable Software and Affected Versions Suricata versions 8.0.0 through 8.0.5 Description The SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. When a SIP body exceeds 65,536 bytes, the length is truncated. This prevents frame:request.bo...

AlmaLinux 9 : python3.14 (ALSA-2026:41949)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:41949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

Info.plist parser USB driver Cryptographic tokens CCID/ICCD DoS

The vulnerability of the Info.plist parser, USB driver for smart card readers, and cryptographic tokens that comply with CCID/ICCD standards is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to cause a service failure...

Oracle Linux 9 : dovecot (ELSA-2026-41905)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41905 advisory. 1:2.3.16-18.1 - fix CVE-2026-42006: IMAP parser listcountlimit bypass via open parentheses RHEL-188468 Tenable has extracted the preceding description block...

Amazon Linux 2 : clamav1.4, --advisory ALAS2-2026-3820 (ALAS-2026-3820)

The version of clamav1.4 installed on the remote host is prior to 1.4.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3820 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS...

KLA91170 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Denia...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18979 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.2.0 and more Source cves: CVE-2026-12590 Source advisory: OSV:GHSA-V422-HMWV-36X6...

EUVD-2026-42577

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement...

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement vulnerability discovered by ? in WordPress Npm body-parser versions 1.20.6...

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

Impact When body-parser is configured with an invalid limit option value, such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept...

GHSA-V422-HMWV-36X6 body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

Impact When body-parser is configured with an invalid limit option value, such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18979 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.2.0 and more Source cves: CVE-2026-12590 Source advisory: GHSA-V422-HMWV-36X6...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @appium/base-driver (>=10.0.0-rc.2, <=10.7.1) +164 more potentially affected by CVE-2026-12590 via body-parser (>=2.0.2, <=2.2.2)

body-parser NPM version =2.0.2, =0.3.1, =10.0.0-rc.2, =3.2.0, =4.2.0, =2.0.32, =1.4.0, =1.1.1, =1.0.15, =1.0.15, =1.0.1-beta.1, =9.1.1-ruixiang.1, =9.0.0, =3.0.10, =3.8.8, =1.114.0, =3.20.1 and more Source cves: CVE-2026-12590 Source advisory: OSV:GHSA-V422-HMWV-36X6...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @appium/base-driver (>=10.0.0-rc.2, <=10.7.1) +164 more potentially affected by CVE-2026-12590 via body-parser (>=2.0.2, <=2.2.2)

body-parser NPM version =2.0.2, =0.3.1, =10.0.0-rc.2, =3.2.0, =4.2.0, =2.0.32, =1.4.0, =1.1.1, =1.0.15, =1.0.15, =1.0.1-beta.1, =9.1.1-ruixiang.1, =9.0.0, =3.0.10, =3.8.8, =1.114.0, =3.20.1 and more Source cves: CVE-2026-12590 Source advisory: GHSA-V422-HMWV-36X6...

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Summary Pillow's EPS parser PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive. A crafted EPS file can cause Image.open to seek backwards to the same directive and parse it repeatedly, resulting in an infinite loop and CPU denial of service. The issue is triggered...

CVE-2026-53727

A flaw was found in cssparser from 2.2.0 before 3.0.0. CssParser::Parserreadremotefile used by loaduri! and @import handling in addblock! issues HTTP/HTTPS requests without host, IP, or scheme restrictions, including to loopback and RFC1918 targets, and recursively follows Location redirects. Tho...

CVE-2026-64624 FreeRDP RDP File Parser Remote Code Execution via CLI Options

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...