ROS-20260911-73-0244

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107260)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107260 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the...

org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output

A flaw was found in Apache Log4j's JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This...

CVE-2026-2310

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-2310 IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-2310

IBM webMethods Integration Server 11.1 is vulnerable to an XML External Entity Injection (XXE) flaw when processing XML data, as described by CWE-91 (XML Injection). A remote attacker with low privileges and a local attack vector can exploit this to expose sensitive information or consume memory ...

CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

Security Bulletin: IBM MQ Appliance is affected by an integer overflow vulnerability (CVE-2026-11725)

Summary IBM MQ Appliance has addressed an integer overflow vulnerability. Vulnerability Details CVEID:CVE-2026-11725 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing...

Security Bulletin: IBM MQ Appliance is affected by a buffer overflow vulnerability in compressed data channel processing (CVE-2026-10027)

Summary IBM MQ Appliance has addressed a buffer overflow vulnerability that could allow a remote attacker to cause a denial of service or execute arbitrary code by sending malformed compressed data on channels configured with compression enabled. Vulnerability Details CVEID:CVE-2026-10027...

Security Bulletin: IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing (CVE-2026-10747)

Summary IBM MQ Appliance has addressed a heap buffer overflow vulnerability in protocol message processing that could allow a remote attacker to cause a denial of service or execute arbitrary code prior to authentication. Vulnerability Details CVEID:CVE-2026-10747 DESCRIPTION: IBM MQ could allow ...

org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output

A flaw was found in Apache Log4j's JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This...

CVE-2026-87961

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

CVE-2026-87961 ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

CVE-2026-87961 ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

CVE-2026-87961 ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

vim: Vim: Arbitrary command execution via crafted vimball

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function...

CVE-2026-0310

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service DoS condition on VM-Series firewalls or execute arbitrary co...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

CVE-2026-0310 PAN-OS: Buffer Overflow Vulnerability via XML Processing

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service DoS condition on VM-Series firewalls or execute arbitrary co...

CVE-2026-0310 PAN-OS: Buffer Overflow Vulnerability via XML Processing

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service DoS condition on VM-Series firewalls or execute arbitrary co...