CVE-2026-85473

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-78633

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests...

Deadlock

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling process. A...

CVE-2026-85473 Out-of-Range Timestamp Claim Handling in auth0/java-jwt

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-85473

The auth0/java-jwt library is vulnerable to a flaw where it may terminate a thread upon receiving a JSON Web Token (JWT) containing an out-of-range value in timestamp claims such as exp , nbf , or iat . This issue occurs during the token parsing phase, specifically before signature verification t...

CVE-2026-78633

The Okta RADIUS Agent contains a Denial of Service vulnerability due to improper validation of the sub-attribute length during the parsing of a Vendor-Specific attribute . If a sub-attribute length of zero is provided, the parser enters an infinite loop , leading to worker-thread exhaustion . Thi...

CVE-2026-78633 Denial of Service in Okta RADIUS Agent Packet Parser

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests...

CVE-2026-109941

The FreeRDP application versions 2.3.0 before 3.32.0 is vulnerable to an infinite loop within the http_chuncked_read function. This flaw allows a malicious RD Gateway to hang a client by transmitting an incomplete chunked response, such as a partial chunk-size line or footer, followed by a TLS sh...

CVE-2026-19936: Concurrent Execution using Shared Resource with Improper Synchronization

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

ROS-20261013-73-0004

The vulnerability of the powerpc/eeh component of the Linux operating system’s kernel is related to errors during thread blocking. Exploiting this vulnerability can allow an attacker to cause a service failure...

Security Vulnerabilities fixed in Thunderbird 153.5 — Mozilla

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours...

CVE-2026-19936 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

CVE-2026-108952

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rxringbuffer as a Serial V2 rtserialrxfifo in functionenable. A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members...

CVE-2026-108952 RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rxringbuffer as a Serial V2 rtserialrxfifo in functionenable. A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members...

CVE-2026-108952

RT-Thread versions through 5.3.0 are vulnerable to a memory corruption issue within the legacy USB CDC virtual COM port driver . The root cause is the aliasing of rx_ringbuffer as a Serial V2 rt_serial_rx_fifo inside the _function_enable() function. A connected USB host configuring the CDC device...

CVE-2026-108952 RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rxringbuffer as a Serial V2 rtserialrxfifo in functionenable. A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members...

EUVD-2026-97359

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rxringbuffer as a Serial V2 rtserialrxfifo in functionenable. A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members...

CVE-2026-108789

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly...

CVE-2026-108789 deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly...

EUVD-2026-97158

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly...