CVE-2026-61844 is a vulnerability in FileRise, a self-hosted web-based file manager, affecting versions prior to 3.18.0. The issue arises from how FileRise flattens logical folder paths into metadata filenames, causing distinct folders to share one metadata file. This allows a low-privileged user with control over one colliding folder and read_own access to another folder to manipulate metadata, potentially gaining unauthorized read and edit access to files. The vulnerability is fixed in version 3.18.0.
FileRise versions prior to 3.18.0 contain a missing authorization vulnerability that allows unauthenticated users with a valid share token and any configured share password to overwrite existing files by uploading a file with the same name. This flaw also affects authenticated uploads where users lack edit permissions, enabling silent replacement of file content without changing the original uploader metadata. The issue is resolved in version 3.18.0.
PgBouncer versions 1.17.0 through 1.26.0 contain an improper authentication vulnerability that allows a remote attacker who knows a user's password to log in as any other SCRAM-authenticated user, including admin and superuser accounts. This occurs because a second StartupMessage during SCRAM authentication against a non-existent database is not rejected and switches the logged-in user while still verifying the SCRAM exchange against the first user's credentials.
PgBouncer versions 1.20.0 through 1.26.0 contain an infinite loop vulnerability triggered by a crafted StartupMessage with an empty parameter name. This causes the server process to become unresponsive, resulting in denial of service until restarted.
An integer overflow vulnerability exists in the message buffer growth logic (mbuf_make_room) of PgBouncer versions 1.21.0 through 1.26.0. When max_packet_size is configured above 2147483648, a crafted packet header with a length exceeding 2^31 causes the buffer size calculation to overflow. This results in an infinite growth loop that saturates a CPU core and stalls all pooled connections until the PgBouncer process is restarted. Since version 1.23.0, this overflow can be triggered before authentication with a five-byte packet header.
CVE-2026-108395 is a high-severity vulnerability in the Model Context Protocol Java SDK affecting multiple versions of the io.modelcontextprotocol.sdk:mcp artifact and mcp-core. The issue arises because certain server transports read HTTP request bodies into memory without enforcing a maximum size limit. This allows an unauthenticated remote attacker to send arbitrarily large POST requests, potentially exhausting the Java process heap and causing denial of service. The vulnerability affects versions from 0.8.0 up to but not including 0.13.0, from 0.13.0 up to 0.18.4, from 1.0.0 up to 1.1.4, and from 2.0.0-M1 up to 2.0.1. Fixed versions are 0.18.4, 1.1.4, and 2.0.1. Mitigations include authentication, origin or host validation, or upstream request size limits to reject malicious requests before they reach the vulnerable code.
A vulnerability in the Erlang OTP standard library's erl_tar module and related modules in hexpm and rebar3 allows an attacker to cause a denial of service by supplying a crafted tar archive with a GNU sparse member. The extraction process enters an infinite loop due to improper handling of sparse map data, causing the process and scheduler to hang until killed. This affects OTP versions from 29.0 before 29.1.2, rebar3 from 3.27.1 before 3.28.0, stdlib from 8.0 before 8.1.1, hex from 2.4.2 before 2.5.3, and hex_core from 0.14.0 before 0.20.1. OTP 28 is not affected unless using affected hex_core, Hex, or rebar3 versions.
A vulnerability in Erlang OTP ssl modules allows a malicious TLS 1.3 server to cause a denial of service on the client node by exploiting improper validation of NewSessionTicket message extensions. This leads to repeated crashes of the ssl application, potentially taking down all ssl connections on the node. The issue affects OTP versions from 23.3 before 27.3.4.19, 28.5.0.8, and 29.1.2, corresponding to ssl versions 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.
A vulnerability in DPDK lib/vhost involves a double-offset bug in the vhost log mapping calculation that can cause incorrect memory access. This flaw can be triggered by a malicious guest controlling the vhost-user log mapping. The issue has a high severity rating with a CVSS score of 7.8, impacting confidentiality, integrity, and availability. Currently, no mitigation or fix is available according to the Red Hat advisory.
RabbitMQ versions from 3.13.0 up to but not including 3.13.19, and certain 4.x versions, contain a vulnerability in the MQTT 5 parser where an authenticated publisher can send an invalid property in PUBLISH packets. This causes a function_clause exception on the subscriber side, closing the subscriber's MQTT connection without affecting the publisher or broker availability. The issue does not lead to message replay, retained-message persistence, or broker-wide denial of service. Fixed versions include 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
A vulnerability in the DPDK GSO library allows remote or guest-supplied packets to trigger out-of-bounds read or write due to improper header size checks during software GSO packet processing. This can lead to heap memory corruption, causing process crashes or potential code execution without elevated privileges. The issue affects environments using software GSO on untrusted network sources or guest interfaces. Workloads relying solely on hardware-based segmentation offloading are not impacted.
CVE-2026-105236 is an improper certificate validation vulnerability in the ssl application of Erlang/OTP. It allows a client trusted by one SNI virtual host to authenticate to another SNI virtual host on the same listener by resuming a TLS 1.2 session. The issue arises because the server's session cache is shared across SNI names without binding sessions to specific SNI names or client trust policies. This affects Erlang/OTP versions from 18.0 up to but not including 27.3.4.19 and ssl versions from 7.0 up to but not including 11.2.12.14. TLS 1.3 is not affected. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity).
Janus WebRTC Server versions through 1.4.3 have a path traversal vulnerability in the Record&Play plugin. This flaw allows unauthenticated attackers to write files outside the designated recordings_path by manipulating the record request filename with path separators. The vulnerability enables attackers to create or truncate files ending with -audio.mjr, -video.mjr, or -data.mjr anywhere the Janus process has write permissions outside protected folders.
Sofia-SIP versions through 1.13.18 have a heap out-of-bounds read vulnerability in the msg_multipart_parse() function. This flaw allows unauthenticated remote attackers to crash the process by sending an INVITE request with a multipart Content-Type header containing an oversized MIME boundary. The oversized boundary causes the memcmp function to read beyond the allocated heap buffer, resulting in a denial of service.
miniupnpc versions through 2.3.3 have a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling. This flaw occurs because the code skips an end-of-buffer check after advancing past a colon character ':'. A malicious or spoofed UPnP gateway on the local network can exploit this by sending a device description or SOAP reply with an element name ending in ':', causing the client to crash.
miniupnpc versions through 2.3.3 contain a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function. This flaw allows malicious UPnP gateways on the local network to read past buffer bounds via crafted replies, potentially causing client crashes when device descriptions or SOAP responses end with '='.
A vulnerability in the DPDK vhost library allows a malicious guest to cause a denial of service on the host vhost process by manipulating the virtio indirect descriptor table length. This can lead to out-of-bounds memory access, causing the host process to crash or become disrupted. The issue arises from a time-of-check to time-of-use (TOCTOU) race condition in handling the descriptor table length and is a residual problem from a previous fix (CVE-2018-1059).
A vulnerability in DPDK lib/vhost involves inadequate validation of memory size before mmap during vhost memory-region setup. This flaw can be triggered by a malicious guest controlling vhost-user memory table messages, potentially causing a host crash or memory corruption. The issue affects multiple Ubuntu package versions of DPDK. No mitigation is currently available, and the vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.