A heap-based buffer overflow vulnerability exists in pymonocypher versions prior to 4.0.2.8 in the argon2i_32 implementation. The issue arises because the implementation does not verify the size of the nb_blocks parameter, allowing a buffer overflow if the caller provides an insufficiently sized buffer. This flaw has been fixed in version 4.0.2.8.
CVE-2026-70409 is a medium-severity vulnerability in Erlang/OTP's eldap module involving improper validation of the port component in LDAP referral URLs. A malicious or compromised LDAP server can supply a referral URL with an excessively long numeric port, causing the eldap:parse_port/2 function to perform costly arbitrary-precision integer conversions. This can degrade application availability by consuming significant processing time. The flaw affects multiple OTP versions from 17.0 up to but excluding patched versions 27.3.4.17, 28.5.0.6, and 29.0.6, as well as corresponding eldap library versions. Exploitation requires the application to pass server-supplied referrals to eldap:parse_ldap_url/1, which eldap itself does not call internally. No known exploits are reported in the wild.
CVE-2026-70405 is a medium severity vulnerability in Erlang/OTP's SNMP component caused by improper validation of the specified quantity in input. A remote attacker can send an SNMP message with a BER INTEGER whose length field is arbitrarily large, leading to excessive resource consumption during decoding. This can degrade system availability. The issue affects multiple OTP and SNMP versions prior to specific fixed releases.
CVE-2026-59696 is a medium severity vulnerability in Erlang/OTP's stdlib where improper validation of the port component in a URI allows a remote attacker to degrade service availability. The vulnerability arises because the function uri_string:get_port/1 converts a very long numeric port string to an integer without length bounds, causing excessive CPU consumption. This affects all applications parsing attacker-supplied URIs using uri_string:parse/1. The issue impacts OTP versions from 21.0 up to but not including 27.3.4.17, 28.0 up to 28.5.0.6, and 29.0 up to 29.0.6, as well as corresponding stdlib versions. No exploits are known in the wild, and no explicit patch links are provided in the data.
CVE-2026-71562 is a medium severity vulnerability in Erlang/OTP's inets httpc module involving improper validation of numeric header values. A malicious HTTP server can send a very long numeric header (e.g., Content-Length) that triggers expensive arbitrary-precision integer conversions, causing performance degradation. This affects multiple OTP and inets versions prior to specific patch releases.
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value.
Ash.Type.Decimal cast input through Ecto's decimal cast in cast_input/2 and cast_stored/2 (lib/ash/type/decimal.ex) without checking that the resulting value is finite. Elixir's Decimal represents Infinity and NaN as valid structs, so a value such as "Infinity" or "NaN" passed casting and was persisted. Because NaN compares as false against every bound, min and max constraints do not reject it, and the stored special value later raises when used in Decimal arithmetic or is refused by the data layer, failing subsequent requests. The fix rejects any non-finite Decimal during casting.
This issue affects ash: from 1.28.0 before 3.32.2.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted.
This issue affects Newspapers X: from 1.0.46 through 1.0.48.
HTML::FormFu versions up to 2.08 for Perl contain a vulnerability that allows resource exhaustion via an unbounded repeat count in Repeatable elements. The repeat count is read from a query string parameter and only validated as a positive integer, with no upper limit enforced. This can cause excessive cloning of form elements, leading to high memory and CPU consumption. Nested Repeatable elements multiply the cloning effect exponentially. The vulnerability can be triggered by unauthenticated GET requests, potentially exhausting server resources.
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
CVE-2026-81851 is a heap-based buffer overflow vulnerability in the iked process of WatchGuard Fireware OS. It allows an authenticated administrator to cause a denial of service by crashing the IKE daemon through saving a specially crafted configuration. The vulnerability affects specific versions of Fireware OS. No official patch or remediation guidance is currently provided by the vendor. The CVSS 4.0 score rates this vulnerability as medium severity.
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
CVE-2026-59317 is a medium severity vulnerability in Spring for Apache Kafka where the DeadLetterPublishingRecovererFactory component improperly validates the retry_topic-original-timestamp header from inbound ConsumerRecords. It directly converts the raw header bytes to a BigInteger without length or format validation, potentially leading to issues affecting availability. Multiple versions of Spring for Apache Kafka are affected, including 2.8.12 and earlier through 4.1.0. No official patch or remediation guidance is currently provided.
CVE-2026-45201 is a high-severity vulnerability in Imagination Technologies Graphics DDK where improper validation of a specified log2 page size during GPU system calls can lead to out-of-bounds (OOB) read and/or write. This occurs when software running as a non-privileged user passes an invalid log2 page size, causing 4K pages to be treated as higher order pages and enabling memory access beyond intended boundaries.
A vulnerability in Tor before version 0.4.9.9 causes an infinite loop when decompressing a truncated zlib/gzip stream with done=1. The issue arises because the decompression never reaches the expected end state, leading to a retry loop. This flaw was fixed by returning an error to allow clean aborting of the operation.
CVE-2026-53587 is a high-severity vulnerability in libgit2 prior to versions 1.8.6 and 1.9.5. It involves improper input validation in the smart-protocol pkt-line capability buffer, leading to a heap out-of-bounds read that can crash clients during the first refs-advertisement packet over various Git protocols. The issue is fixed in libgit2 versions 1.8.6 and 1.9.5.
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.
DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.
preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.
Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.
An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.