MiracleLinux 9 : brotli-1.0.9-10.el9_8 (AXBA:2026-2004:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXBA:2026-2004:03 advisory. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compress...

CVE-2026-108039: Improper Restriction of Recursive Entity References in DTDs

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input for example SAAJ or WS-Security, and could...

Microsoft SQL Server Privilege Escalation

The vulnerability of the Microsoft SQL Server database management system is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-67693

A flaw was found in GnuTLS. The certificate verification process fails to properly reject end-entity digital certificates containing contradictory Key Usage KU and Extended Key Usage EKU extensions, which define the permitted cryptographic operations of a certificate. A remote attacker could...

bind: bind9: Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

AZL-107448 CVE-2026-67693 affecting package gnutls 3.8.13-1

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage KU and Extended Key Usage EKU...

DEBIAN-CVE-2026-67693

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage KU and Extended Key Usage EKU...

CVE-2026-67693

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage KU and Extended Key Usage EKU...

CVE-2026-67693

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage KU and Extended Key Usage EKU...

UBUNTU-CVE-2026-67693

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage KU and Extended Key Usage EKU...

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...

msgpack5: Quadratic parsing in the streaming decoder

Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop. Patches The decoder now preserves incremental...

SUSE CVE-2026-98226

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count SWAPUSAGEOFFLISTBIT is embedded in the si-inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from...

SUSE CVE-2026-98369

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

CVE-2026-107678

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...

EUVD-2026-95075

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local webfetchtool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

CVE-2026-107287

The Pydantic AI Python agent framework contains a vulnerability where the local web_fetch_tool and WebFetch local fallback exhibit excessive CPU and memory consumption. This is caused by inefficient processing during the HTML-to-Markdown conversion of attacker-controlled HTML containing deeply ne...

CVE-2026-105399 ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image...

CVE-2026-107581 Inefficient Algorithmic Complexity in hMailServer

Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY...

CVE-2026-107581

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to Inefficient Algorithmic Complexity (CWE-407) and Excessive Memory Consumption (CWE-400) via IMAP commands. The vulnerability stems from several issues: the FETCH data-item parser uses a case-insensitive string replacemen...