Search: 16.5-2

CVE-2026-90797 is a critical vulnerability in Apache CouchDB 3's chttpd component involving an unlimited gzip decompression routine. This flaw could allow an attacker to cause resource exhaustion or denial of service by sending specially crafted compressed data. The vulnerability affects version 1.6.0-0ubuntu7 of the couchdb package. The CVSS 4.0 base score is 9.2, indicating a high severity with network attack vector and no required privileges or user interaction.

CVE-2026-86471 is a critical vulnerability in Apache CouchDB involving an unvalidated runtime configuration value. It affects at least version 1.6.0-0ubuntu7. The flaw has a high CVSS 4.0 score of 9.3, indicating network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No public exploits or known active exploitation have been reported. Patch or remediation status is not confirmed from the available data.

CVE-2026-107755 is a high-severity vulnerability in CouchDB version 1.6.0-0ubuntu7 involving insufficient filtering of credentials in the _replicator database. This flaw could potentially expose sensitive credential information. The vulnerability has a CVSS 4.0 score of 8.9, indicating significant impact if exploited. No public exploits or known active exploitation have been reported. The affected version is specifically 1.6.0-0ubuntu7.

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

CVE-2026-95107 is an integer overflow vulnerability in the Eclipse Foundation's Eclipse ThreadX module manager. The vulnerability occurs when the module manager adds a 16-byte private header to an object size without checking for overflow, causing the size to wrap around. This results in the allocation of a smaller memory block than required, leading to a buffer overflow where the header is written past the allocated block into adjacent memory.

CVE-2026-95168 is a high-severity vulnerability in the software 'thefuck' version 3.32 and several other specific versions. It allows a local attacker to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability requires local access and low attack complexity without user interaction. Multiple specific versions are affected, but no patch or remediation information is provided.

An incomplete cleanup vulnerability in Apache Tomcat affects TLS 1.3 connections, causing them to fail intermittently. This issue impacts Apache Tomcat versions from 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122. Upgrading to versions 11.0.27, 10.1.61, or 9.0.123 resolves the problem.

A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in Apache Tomcat's APR/Native connector when creating Unix domain sockets. This flaw allows an unauthorized local user to access the Unix domain socket. The issue affects Apache Tomcat versions from 9.0.47 through 9.0.122. The vulnerability was not addressed by the fix for CVE-2026-65183, which only covered the NIO connector. Users should upgrade to version 9.0.123 to resolve this vulnerability.

An Execution After Redirect (EAR) vulnerability exists in multiple versions of Apache Tomcat, including versions from 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, 9.0.0.M1 through 9.0.122, and older EOL versions such as 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109. The vulnerability allows execution of code after a redirect operation. Fixed versions are 11.0.27, 10.1.61, and 9.0.123. Users should upgrade to these or later versions to remediate the issue.

A buffer under-read vulnerability exists in Apache Tomcat 6 and 7 versions, allowing an attacker to cause a denial of service by triggering a large number of requests. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity with high impact on confidentiality and availability. Multiple specific versions of Tomcat 6.0.37-1 through 7.0.52-1ubuntu0.14 are affected.

An incorrect object recycling and re-use vulnerability exists in Apache Tomcat versions 6.0.37-1, 6.0.39-1 and related builds, as well as several 7.0.x versions up to 7.0.52-1ubuntu0.14. This vulnerability could allow an unauthenticated remote attacker to cause a denial of service and potentially impact confidentiality due to improper handling of recycled objects.

CVE-2026-101296 is a critical vulnerability in Apache Tomcat 6 and 7 versions that involves a missing critical step in the authentication process. This flaw allows an attacker to potentially bypass authentication controls, leading to high-impact security risks. The vulnerability has a CVSS 4.0 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. It affects multiple specific versions of Tomcat 6.0.37 through 7.0.52, including various Ubuntu package builds. No public exploits or known in-the-wild exploitation have been reported yet. No patch or remediation information is provided in the available data, so patch status is not confirmed.

Pingora versions prior to 0.8.1 used the h2 crate's default HTTP/2 server limits, a 16 MiB decoded header-list size and no limit on concurrent streams, unless the application set its own. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process. This affects any Pingora service that terminates HTTP/2 (h2 or h2c) without explicitly setting `max_header_list_size` and `max_concurrent_streams`. The reporter showed that a single connection could get a Pingora process with a 2 GiB memory limit OOM-killed. This flaw was corrected in commit d193c8d49b8b7c1c1ede93183759caa4f6906bbd. When no `H2Options` are supplied, Pingora now advertises and enforces a 64 KiB decoded header-list limit and at most 100 concurrent streams per connection. Users should upgrade to Pingora >= 0.8.1. Applications that supply their own `H2Options` are not covered by these defaults and must set `max_header_list_size` and `max_concurrent_streams` explicitly, or start from `pingora_core::protocols::http::v2::server::default_h2_options()`. `H2Options::default()` does not include these limits. Note: Cloudflare CDN customers were unaffected, as internal Pingora services at Cloudflare do not have HTTP/2 clients.

A denial of service vulnerability exists in libexpat versions 2.7.2 through 2.9.0 due to improper handling in the XML_ParserReset function. This function zeroes the direct byte count but does not offset tracked heap allocations, allowing an attacker to cause subsequent XML parsing operations to fail with an out-of-memory error until the parser is recreated.

DokuWiki versions before 2026-07-14c contain a PHP object injection vulnerability that allows an attacker with low privileges to execute code remotely. The vulnerability has a high severity with a CVSS score of 7.5, impacting confidentiality, integrity, and availability. Multiple specific versions of DokuWiki are affected, including various dated builds and Ubuntu package versions. No public exploits or known active exploitation have been reported. The vulnerability requires high attack complexity and no user interaction but only low privileges.

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a vulnerability identified as CVE-2026-113386. The vulnerability has a high severity with a CVSS score of 7.1, indicating it allows an attacker with low privileges to cause a partial impact on confidentiality and a high impact on integrity without user interaction. The exact nature of the vulnerability is not detailed in the provided data.

UnRTF by the GNU Project contains an out-of-bounds write vulnerability identified as CVE-2026-109831. This flaw can be triggered when a user processes crafted input, potentially leading to limited integrity and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 5.4. Multiple specific versions of UnRTF are affected.

compress-lzf versions 1.0.3-1, 1.0.4-1, and 1.0.4-1build1 contain an out-of-bounds memory access vulnerability. This flaw can lead to a critical impact including high confidentiality loss and high availability impact. The vulnerability is identified as CVE-2026-109395 and has a CVSS score of 9.1, indicating a critical severity level.

Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.