CVE-2026-75935 Memory-amplification denial of service via declared-length preallocation in Amazon ion-java

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...

CVE-2026-75090

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

EUVD-2026-60035

A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A hig...

Security Bulletin: Code Injection Vulnerability in Code Validation Endpoint

Summary A code injection vulnerability was identified in the code validation endpoint that allowed authenticated users to execute arbitrary code on the server. The vulnerability existed in the validation logic which compiled and executed function definitions to check for import errors. Attackers...

CVE-2026-64598 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-64598 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64561 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-64561 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68444 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68444 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68414 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68414 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68116 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68116 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64482 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64482 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64552 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64552 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64553 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64553 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-63810 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-63810 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68432 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68432 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-65942

The Apache Ranger Client Code in versions

CVE-2026-44630

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

CVE-2026-19359

The CVE affects nxp-auto-goldvip gvip up to 1.4.0, specifically the SitewiseCustomFunction in the Lambda Function Handler. The issue enables improper access controls and can be exploited remotely. A fix is available in version 1.15.0; upgrading the affected component is advised. The accompanying ...

CVE-2026-19245 HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

CVE-2026-19244 HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control

A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connectmcpservers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be...

CVE-2026-19243

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed...