CVE-2026-54610 is a low-severity vulnerability in LibreDWG libredwg versions prior to 0.14. The function bit_TV_to_utf8() can write to a caller-provided buffer marked as const, potentially causing segmentation faults or denial of service if the input buffer is immutable. Mutable inputs may be unexpectedly modified. This issue is fixed in version 0.14.
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes rows from part_config, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0.
Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in StreamingEscrow preserve depositAmount() while an active stream needs an escrow reserve. However, the approve-side dispute resolution path drains the whole available escrow balance to the proposal beneficiary. At time of publication, there are no publicly known patches.
A vulnerability in the ljharb qs library causes qs.stringify to throw a TypeError when serializing objects whose own constructor property has a truthy but non-callable isBuffer member. This occurs because the isBuffer check calls obj.constructor.isBuffer without verifying it is a function. The issue affects versions from 2.2.5 up to but not including 6.16.0 and was fixed in version 6.16.0. An attacker can craft input that triggers this error, causing synchronous exceptions during serialization. In typical Node.js HTTP frameworks, this results in a 500 error response without crashing the process, but in some cases, such as async handlers or background jobs without error boundaries, it can cause process termination.
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs.
CVE-2026-47316 is a medium severity vulnerability in Samsung Open Source Escargot caused by improper check or handling of exceptional conditions, which allows input data manipulation. It affects a specific version of Escargot identified by commit 590345cc6258317c5da850d846ce6baaf2afc2d3. The vulnerability does not impact confidentiality or integrity but can cause availability issues. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers. Version 4.81.0 patches the issue.
CVE-2026-31794 is a medium severity vulnerability in iccDEV, a library for handling ICC color profiles. Versions prior to 2.3.1.5 contain an out-of-bounds read in the CIccCLUT::Interp3d() function, leading to a segmentation fault and denial of service. Exploitation requires local access and user interaction, but no privileges. The flaw does not impact confidentiality or integrity but causes application crashes, affecting availability. No known exploits are reported in the wild. The vulnerability is fixed in version 2.3.
CVE-2026-31793 is an out-of-bounds read vulnerability in the InternationalColorConsortium's iccDEV library versions prior to 2.3.1.5. The flaw occurs in the CIccCalculatorFunc::ApplySequence() function, where an invalid or wild pointer read can cause a segmentation fault, leading to denial of service. Exploitation requires local access and user interaction, but no privileges are needed. The vulnerability impacts availability without affecting confidentiality or integrity. No known exploits are currently reported in the wild. The issue is fixed in version 2.3.
2N Access Commander application version 3.4.2 and prior returns HTTP 500 Internal Server Error responses when receiving malformed or manipulated requests, indicating improper handling of invalid input and potential security or availability impacts.
malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes. Version 1.21.0 fixes the issue.
Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection.
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
CVE-2025-68135 is a medium-severity vulnerability in the EVerest everest-core EV charging software stack prior to version 2025.10.0. It arises from improper handling of C++ exceptions in the TbdController loop, causing silent termination of the loop and its caller. This results in denial of service (DoS) conditions affecting the SDP and ISO15118-20 servers, which are critical for EV charging communication protocols. No known exploits are currently reported in the wild. The vulnerability does not impact confidentiality or integrity but severely affects availability. The issue is fixed in version 2025.10.0.
The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue.
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.
CVE-2025-47913 is a high-severity vulnerability in the golang.org/x/crypto SSH agent package where SSH clients panic and terminate unexpectedly upon receiving an SSH_AGENT_SUCCESS message when a typed response is expected. This improper handling of exceptional conditions (CWE-703) leads to denial of service by crashing the client process without requiring authentication or user interaction. The vulnerability affects all versions of the golang.org/x/crypto/ssh/agent package and has a CVSS score of 7.5, indicating significant impact on availability. No known exploits are currently reported in the wild. European organizations using Go-based SSH clients that rely on this package may face service disruptions, particularly in critical infrastructure and development environments. Mitigation involves updating to patched versions once available and implementing robust error handling around SSH agent responses. Countries with strong software development sectors and critical infrastructure relying on Go are most at risk, including Germany, France, the UK, and the Netherlands.
