CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

CVE-2026-110686 Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

CVE-2026-110686 Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

CVE-2026-110686 Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

CVE-2026-110686

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

EUVD-2026-104565

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

CVE-2026-110686

The Cpanel::JSON::XS Perl module versions prior to 4.80 are vulnerable to a Use After Free (CWE-416) flaw during the decode_hv process. The vulnerability occurs because the decoder copies the filter_json_object and filter_json_single_key_object callbacks without maintaining proper references. If ...

CVE-2026-110681

The Cpanel::JSON::XS Perl module (versions before 4.80 ) is vulnerable to a use-after-free issue. The root cause is that a parser object holds its callbacks and incremental parse buffer as raw scalar pointers . When a thread is created, these pointers are copied into a new ithread interpreter unc...

CVE-2026-110681 Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter...

CVE-2026-110681 Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter...

Security Bulletin: The Use Case Manager App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Use Case Manager App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-87776 DESCRIPTION: compression is...

CVE-2026-80229

A flaw was found in libcurl when performing transfers via its multi interface with OpenSSL 3 provider configurations. Pooled TLS connections can outlive their originating easy handles, causing an allocated library context to be prematurely freed. This leaves the active connection with a dangling...

CVE-2026-98464

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine implementation for the RISC-V architecture. This vulnerability can lead to a Denial of Service DoS or host system crash due to a use-after-free memory issue during virtual machine teardown. A race condition allows a timer...

CLSA-2026-1791493434 Fix CVE(s): CVE-2026-19445, CVE-2026-4786

SECURITY UPDATE: use-after-free in the ssl servername SNI callback CVE-2026-19445 - debian/patches/CVE-2026-19445.patch: look the SSLContext up from the SSL object instead of the borrowed pointer registered with OpenSSL, hold references to it and to the callback while it runs, and unregister the...

CLSA-2026-1791372827 Fix CVE(s): CVE-2026-19445, CVE-2026-4786

SECURITY UPDATE: use-after-free in the ssl servername SNI callback CVE-2026-19445 - debian/patches/CVE-2026-19445.patch: look the SSLContext up from the SSL object instead of the borrowed pointer registered with OpenSSL, hold references to it and to the callback while it runs, and unregister the...

CVE-2026-98520

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. In multi-container environments, terminating an initial container session that accessed the GPU interface leaves behind an invalid internal memory reference. When a subsequent GPU reset occurs, accessing this freed reference triggers a...

CVE-2026-98463

A flaw was found in the Linux kernel's schedext extensible scheduler subsystem. Improper handling of wakeup enqueue flags during remote task activation can cause a deferred action request to remain pending after the scheduler is disabled. When a new scheduler initializes and processes deferred...

CVE-2026-98524

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS subsystem. When memory region mapping fails during InfiniBand operations, the kernel can retain a stale reference to memory buffers that have already been released. A local attacker could exploit this flaw to trigger a...

CVE-2026-98512

A flaw was found in the Linux kernel's Nouveau graphics driver. When destroying a GPU scheduler object, the driver frees memory prematurely while user-space synchronization objects still hold references to it. A local, unprivileged user could exploit this flaw by querying synchronization file...

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. Impact An attacker could cause resource exhaustion through specially crafted requests...