CVE-2026-119135

A flaw was found in Wasmtime. This vulnerability allows a guest WebAssembly module to cause a Denial of Service DoS by crashing the host application. When the host reads a component model stream that uses a mismatched internal data type, an assertion failure triggers an unhandled panic instead of...

github.com/klauspost/compress: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

github.com/klauspost/compress: klauspost/compress: Denial of Service via crafted zstd compressed input

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

EUVD-2026-88743

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

Pocketbase: Unhandled panic in worker goroutines

PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process. To prevent this from hapenning all existing internal worker functions...

GHSA-84VH-M24Q-WJJX Pocketbase: Unhandled panic in worker goroutines

PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process. To prevent this from hapenning all existing internal worker functions...

CVE-2026-82410 Pocketbase: Unhandled panic in worker goroutines

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server proces...

CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...