EUVD-2026-41088

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable...

CVE-2026-56150

Allocation of Resources Without Limits or Throttling CWE-770 in Fleet Server can lead to a denial of service via Excessive Allocation CAPEC-130. An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server...

CVE-2026-6688

FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps to CWE-120 Buffer Copy...

CVE-2026-6684

FatFs prior to R0.16 that use GPT scanning with 'FFLBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTHPtNum, enabling extremely long or effectively infinite mount-time scans. This maps to CWE-835 Loop with Unreachable Exit Condition. Estimated CVSS v3.1...

DEBIAN-CVE-2026-14324

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...

AZL-92015 CVE-2026-14324 affecting package pipewire 0.3.60-3

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...

CVE-2026-14330

Multiple unbounded alloca calls in the PulseAudio protocol server...

DEBIAN-CVE-2026-14330

Multiple unbounded alloca calls in the PulseAudio protocol server...

AZL-92012 CVE-2026-14330 affecting package pipewire 0.3.60-3

Multiple unbounded alloca calls in the PulseAudio protocol server...

CVE-2026-14324

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...

CVE-2026-14324

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...

UBUNTU-CVE-2026-14324

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...

CVE-2026-14330

Multiple unbounded alloca calls in the PulseAudio protocol server...

CVE-2026-14330 Pipewire: pulse server alloca stack overflow

Multiple unbounded alloca calls in the PulseAudio protocol server...

EUVD-2026-41007

Multiple unbounded alloca calls in the PulseAudio protocol server...

CVE-2026-14330

Multiple unbounded alloca calls in the PulseAudio protocol server...

CVE-2026-14330

CVE-2026-14330 describes an issue in Pipewire’s PulseAudio protocol server, where multiple unbounded alloca() calls can cause a stack overflow. The affected component is the PulseAudio protocol server within Pipewire. Root cause: unbounded alloca() usage leading to potential stack overflow. Accor...

CVE-2026-14330

Multiple unbounded alloca calls in the PulseAudio protocol server...

CVE-2026-14330

Multiple unbounded alloca calls in the PulseAudio protocol server. Mitigation No practical mitigation beyond upgrading. The PulseAudio protocol server is a core module required for PulseAudio application compatibility...

CVE-2026-14324

CVE-2026-14324 — Pipewire RAOP module vulnerability. The RAOP module accepts unbounded Content-Length values and does not validate the return of pw_array_add(), which can lead to a null dereference. This is a technical detail documented in the CVE record and CVE-list entry. The CVSSv3.1 metrics i...