CVE-2026-123660 affects vulnerability-lookup versions 5.5.1 up to but not including 6.4.1. A signed-in user can craft webhook notification payload templates that cause excessive memory allocation during string formatting, leading to potential denial of service. The vulnerability arises because format specifiers in placeholders are passed unchecked to Python's string formatting, allowing very large memory allocations. Version 6.4.1 fixes this by capping format specifier numbers, limiting rendered template size, and restricting template nesting depth.
dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validating finiteness or the DICOM value-representation rules. Scientific notation overflow in a DS or IS field can produce positive or negative Infinity, while stripping alphabetic characters from signed infinity text can leave a sign-only string that converts to NaN. IntegerString also accepts exponent notation and values outside the DICOM signed 32-bit IS range. Applications that trust these parsed values can propagate invalid numbers into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. This issue is fixed in version 0.52.0.
CVE-2026-94395 is a stack-based buffer overflow vulnerability in the Thales SafeNet Authentication Client (SAC) SIS token engine. It can be triggered by a malicious physical or software-emulated smart card before authentication or PIN entry. The flaw may lead to denial of service or potentially allow arbitrary code execution with the privileges of the affected process. The vulnerability affects SAC versions starting from 10.8 R7 up to and including 10.9 R3 GA (build 10.9.7449).
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe.
CVE-2026-33972 is a vulnerability in the Samsung Semiconductor Exynos 1080 modem's IMS stack where improper validation of specified quantity leads to an out-of-bounds access. This flaw can cause unexpected behavior or crashes in the affected component. A fix was released in October 2026.
CVE-2026-48176 is a memory corruption vulnerability in the Samsung Semiconductor Exynos 1080 caused by improper validation of specified quantity in input messages. This flaw can lead to memory corruption due to insufficient input validation. A fix was released in September 2026.
CVE-2026-20562 is a vulnerability in MediaTek chipsets caused by improper validation of specified quantity in input, leading to a possible out-of-bounds write in the modem component. This flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service without requiring user interaction or additional privileges. The issue is identified by MediaTek as MSV-8907 and has a patch identified as MOLY01775984.
CVE-2026-115274 is a vulnerability in the Elixir standard library's JSON module where improper validation of integer literal length in JSON input can lead to denial of service. Specifically, the JSON.decode/1 and JSON.decode!/1 functions convert integer literals without bounding their length, allowing an attacker to supply extremely large integer values that exhaust CPU and memory resources. This affects Elixir versions from 1.18.0-rc.0 before 1.18.6, 1.19.0-rc.0 before 1.19.7, and 1.20.0-rc.0 before 1.20.5. The issue is fixed in versions 1.18.6, 1.19.7, and 1.20.5.
CVE-2026-109821 is a vulnerability in the Elixir standard library's URI module where improper validation of the port component in a URL can lead to denial of service via CPU exhaustion. The URI.parse/1 function converts the port string to an integer without bounding its length, allowing extremely large port numbers to cause expensive computations when rendering the URI back to text. This affects Elixir versions from 0.5.0 up to but not including 1.18.6, from 1.19.0-rc.0 up to but not including 1.19.7, and from 1.20.0-rc.0 up to but not including 1.20.5. The issue is fixed in versions 1.18.6, 1.19.7, and 1.20.5.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1.
A vulnerability in digitalbazaar forge versions prior to 1.4.1 allows bypassing password-based integrity checks in PKCS#12 processing due to acceptance of zero or negative iteration counts. This leads to predictable encryption keys and IVs in certain password-based encryption schemes, compromising integrity verification. The issue is fixed in version 1.4.1.
When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce request can declare a body size of up to about 2 GiB and force the broker to attempt that allocation, raising OutOfMemoryError. The record size limit (max.message.bytes), the request size limit, and client/broker quotas bound only the compressed wire size, not the declared decompressed size.
Impact:
An authenticated principal with Write on a topic can crash broker request-handler threads (reached when a batch's codec differs from the topic's compression.type and records are re-encoded) and any consumer that fetches the record, denying service. On brokers started with -XX:+ExitOnOutOfMemoryError, a common hardening, a single crafted request terminates the broker JVM. More seriously, a crafted record is accepted at ingest and written to disk; when the log-cleaner later reads it on a compacted topic, the OutOfMemoryError (an Error, not an Exception) terminates the cleaner thread, which is not restarted. With the default of a single cleaner thread, log compaction then stops for the entire broker, including the internal __consumer_offsets and __transaction_state topics, and the condition persists across restarts until the offending record is removed. The impact is availability only; no data is disclosed or altered.
Mitigation:
Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0, and set max.decompressed.message.bytes (at the broker and/or topic level) to a bounded value appropriate for your workload. Upgrading alone is not sufficient: for backward compatibility this configuration defaults to an effectively unlimited value (about 2 GiB), so a broker remains exposed until the limit is set. Choose a value at or slightly above the largest legitimate decompressed record your applications produce, and comfortably below the broker heap divided by the number of request-handler and cleaner threads. Until you can upgrade and configure the limit, restrict Write access to trusted producers; quotas and max.message.bytes do not mitigate this issue.
Resolution:
From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: the broker validates a record's declared decompressed body size against max.decompressed.message.bytes before allocating, on the produce-validation, log-compaction, and timestamp-lookup paths, and rejects oversized or negative sizes with InvalidRecordException. Operators must set this configuration to a bounded value to be protected, as its default is effectively unlimited.
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.
CVE-2026-116581 is a vulnerability in the lxsmnsyc seroval library prior to version 1.6.8. The flaw involves improper validation of a sequence node's done index in the fromJSON and fromCrossJSON functions, which can lead to an infinite loop. An attacker can exploit this by sending crafted input to a service that deserializes untrusted data, causing the event loop to block, exhausting process memory, or making the service unavailable. The issue is fixed in version 1.6.8.
A vulnerability in the zip-rs zip2 library versions from 0.6.0 up to but not including 9.0.0 allows improper validation of the AES entry reader's HMAC authentication tag. Under certain conditions, such as when the encrypted entry has no payload or the underlying reader reaches the end of the archive prematurely, the library may accept modified plaintext without triggering an authentication error. This flaw is fixed in version 9.0.0.
CVE-2026-92386 is a vulnerability in curl where a remote HTTP server can cause curl to write an excessively long cookie record to a Netscape cookie jar. This leads to subsequent curl invocations silently aborting cookie parsing prematurely, ignoring valid cookies that follow the long line.
CVE-2026-94024 is an out-of-bounds read vulnerability in the Eclipse Foundation's Eclipse ThreadX module manager. The vulnerability arises because the object lookup functions do not properly bound the memory search length, allowing a module to cause an unbounded memory walk in privileged mode. This can lead to a fault that disables kernel preemption indefinitely, impacting system stability.
CVE-2026-93475 is a critical out-of-bounds write vulnerability in the X.509 parser of Eclipse ThreadX - NetX Duo. The vulnerability arises because the parser accepts RSA public keys of any size, but signature verification uses fixed-size buffers sized for a maximum modulus of 4096 bits. An attacker can supply a certificate with a larger modulus, causing an out-of-bounds write during certificate-chain verification. This flaw is exploitable pre-authentication and affects both TLS/DTLS clients verifying malicious server chains and servers performing client-certificate authentication.
Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.