protobufjs: protobufjs: Denial of Service via crafted .proto schema

A flaw was found in protobufjs, a JavaScript JS library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library's parsing functions ...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

EUVD-2026-63476

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

CVE-2026-75140

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

CVE-2026-76891

A flaw was found in the sharkd component of Wireshark. A remote attacker could exploit this vulnerability, which requires user interaction and has high attack complexity, by triggering a crash. This issue leads to a denial of service DoS, making the sharkd component unavailable. Mitigation Avoid...

CVE-2026-76884

A flaw was found in Wireshark. A remote attacker could exploit a buffer over-read vulnerability in the ERF Extensible Record Format file parser. This could lead to a denial of service, making the application unavailable to legitimate users. Mitigation Avoid opening ERF Extensible Record Format...

CVE-2026-76917

A flaw was found in Wireshark. A heap-based buffer overflow vulnerability exists within the Bluetooth Audio/Video Remote Control Profile AVRCP protocol dissector. This flaw can be triggered by a local user processing a specially crafted Bluetooth AVRCP packet, which requires user interaction...

CVE-2026-74297

A flaw was found in the Linux kernel's RDMA/mlx5 subsystem. Insufficient validation of a user-provided input, rqwqeshift, in the setrqsize function can lead to an integer overflow. This overflow results in an undefined shift operation, which may cause system instability or a denial of service...

CVE-2026-74294

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC meson audio interface unit AIU component. The AIU HDMI and internal codec mux put callbacks do not properly validate enum values before processing them. This allows an attacker to provide out-of-rang...

CVE-2026-74292

A flaw was found in the Linux kernel's audio driver for Tegra devices, specifically within the AHUB component. This vulnerability arises because a function attempts to read data from an array using an index that has not been properly checked, potentially leading to access beyond the array's...

EUVD-2026-63397

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

CVE-2026-74284

A flaw was found in the Linux kernel's Hierarchical Fair Service Curve HFSC queueing discipline schhfsc. When a child qdisc drops its last packets, the updatevf function can be called twice for the same class, causing it to be marked passive multiple times. This double transition can lead to a...

CVE-2026-74274

A flaw was found in the Linux kernel's CXL Compute Express Link driver. When endpoint decoders are removed from a CXL region's target array, the driver can fail to properly fill the resulting NULL pointer holes. This can lead to the system attempting to access a NULL pointer, causing a general...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.5.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn b...

CVE-2026-74288

A flaw was found in the Linux kernel's networking subsystem. During the process of dumping network routing rules fibrulesdump, a race condition could occur where a 'dying' rule one being deallocated is incorrectly accessed. This could lead to a reference count error, potentially causing a system...

CVE-2026-74286

A flaw was found in the Linux kernel's Packet Forwarding Control Protocol PFCP module. The module fails to properly allocate per-CPU statistics, leaving a pointer uninitialized. A local attacker can exploit this by creating a PFCP rtnetlink device, which triggers a null pointer dereference. This...