org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of...

EUVD-2026-66251

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service...

EUVD-2026-56926

ffuf denial of service OOM via HTTP response decompression bomb...

EUVD-2026-63089

LiquidJS has an infinite loop vulnerability in its striphtml filter...

CVE-2026-85242

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

CVE-2026-84776

Unauthenticated Denial of Service Attack in MalCare Security = 6.69 versions...

CVE-2026-84778

Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning = 6.65 versions...

GHSA-4MVJ-M6J5-PMF7 unstructured: Server-Side Request Forgery in the URL-based partitioning

Summary Server-Side Request Forgery in unstructured. The url= argument of partition, partitionhtml, and partitionmd is fetched via requests.get with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP...

CVE-2026-84778 WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning = 6.65 versions...

EUVD-2026-70572

Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning = 6.65 versions...

CVE-2026-84778

An unauthenticated Denial of Service vulnerability affects the Migrate Guru – Site Migration & Cloning WordPress plugin in versions

EUVD-2026-70574

Unauthenticated Denial of Service Attack in MalCare Security = 6.69 versions...

CVE-2026-84776 WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in MalCare Security = 6.69 versions...

CVE-2026-84776

CVE-2026-84776 affects the MalCare Security WordPress plugin in versions ≤ 6.69 , where an unauthenticated Denial of Service (DoS) attack is possible. The vulnerability requires no user interaction and has low attack complexity , with a network-based attack vector. Per the CVSS 3.1 score of 7.5 (...

CVE-2026-19475

An authenticated user with permission to query a SQL datasource Microsoft SQL Server, PostgreSQL, or MySQL could bypass the fix for CVE-2026-33375 by injecting the $timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing fails to reject. Evaluating the injected macro...

SUSE CVE-2026-71219

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes stack exhaustion...

SUSE CVE-2026-80740

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough that scaledfont exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in...

DEBIAN-CVE-2026-84964

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

DEBIAN-CVE-2026-84966

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...

DEBIAN-CVE-2026-84965

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently larg...