CVE-2026-54451 Elixir protobuf: Unbounded recursion depth in embedded-message decoding

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...

Moderate: Red Hat Security Advisory: rrdtool security update

An update for rrdtool is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

BlockGuard

🛡️ BlockGuard — Agente de seguridad de acceso a archivos basado en procesos BlockGuard es un agente de prevención de pérdida de datos DLP para Windows que intercepta y controla el acceso a archivos a nivel de proceso. Garantiza que solo procesos autorizados — identificados por ruta ejecutable, has...

CVE-2026-52836 OpenDDS: out-of-bounds `rd_ptr` dereference in `RtpsSampleHeader::init` — triggered by malformed RTPS submessage, remotely exploitable denial of service

OpenDDS is an open source C++ implementation of the Object Management Group OMG Data Distribution Service DDS. Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes...

Important: Red Hat Security Advisory: perl-XML-LibXML security update

An update for perl-XML-LibXML is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names

A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and...

CVE-2026-44235

rabbitmq-c (a C-language AMQP client library) prior to 0.16.0 contains an unsigned size_t underflow in amqp_handle_input() (librabbitmq/amqp_connection.c). A malicious AMQP server can send an undersized HEADER or METHOD frame during client login, causing the computed encoded.len to wrap to 0xffff...

CVE-2026-44235 rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed...

CVE-2026-44236 rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin, and rabbitmq-c accepts the value in amqplogininner in librabbitmq/amqpsocket.c. amqptuneconnection in...

CVE-2026-21986-VirtualBox-DoS

CVE-2026-21986 - VirtualBox Shared Folders Kernel Memory Exhaustion DoS Overview This repository contains a proof of concept and technical write-up for CVE-2026-21986, a denial-of-service vulnerability in Oracle VM VirtualBox. The issue exists in the Shared Folders driver interface and allows...

CVE-2026-54580

mport , the MidnightBSD Package Manager, is vulnerable prior to version 2.7.8 in its zstd decompression handling. In libmport/util.c , the function mport_decompress_zstd() did not make every truncated, corrupt, or failed zstd stream fatal, and libmport/fetch.c did not consistently propagate those...

CVE-2026-54580 mport index decompression can leave partial or corrupt index data after zstd failures

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...

CVE-2026-92063

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Audio/Video component...

CVE-2026-81516

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A...

DEBIAN-CVE-2026-76781

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...

perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names

A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and...

Important: Red Hat Security Advisory: perl-XML-LibXML security update

An update for perl-XML-LibXML is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

CVE-2026-85718

AsyncHttpClient (AHC) for Java is affected by a connection permit leak in versions 3.0.8 through 3.0.12. When a TLS connection fails before the handshake completes, NettyConnectListener removes the partition key lock permit from NettyResponseFuture before all failure paths are bound to the channe...

ios-nehelper-enum-apps-0day

nehelper enumerate installed apps 0-day iOS 15.0 I've updated this code to avoid using Private API directly. Read more in my blog post. However, that means that now this code is iOS version-specific and possibly device model-specific. So if it doesn't work on your device, recalculate and update t...

EUVD-2026-81901

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDiscoveryClient deserializes the registry response as one unit, and an unrecognized actionType or status, a non-Boolean...