CVE-2026-68498 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.16.0 onward. It involves uncontrolled resource consumption due to improper enforcement of the maxNameLength constraint when parsing JSON property names from character-based inputs (e.g., String, Reader, char[]). This allows an attacker to cause excessive memory allocation, potentially exhausting heap memory and crashing the process. Byte-input parsers are not affected. The issue arises because the name length check is delayed until after a large buffer allocation, exceeding the intended limit. No authentication is required, and the default configuration is vulnerable.
CVE-2026-68496 is a high-severity vulnerability in the Smile parser component of FasterXML jackson-dataformats-binary. The parser fails to enforce the maxNameLength limit on JSON object property names, allowing an attacker to submit a Smile document with an unboundedly long property name. This leads to uncontrolled memory allocation and potential denial of service due to memory exhaustion. The issue affects multiple jackson-dataformats-binary versions starting from 2.16.0 where the constraint was introduced but not enforced. No special privileges are required to exploit this vulnerability.
CVE-2026-68495 is a high-severity vulnerability in the CBOR parser of FasterXML jackson-dataformats-binary. The parser does not enforce the maxNameLength limit when decoding JSON object property names in CBOR format, allowing an attacker to submit a property name of unbounded length. This can lead to memory exhaustion and denial of service due to unbounded memory allocation during parsing. No special privileges are required beyond the ability to submit data to the parser. The issue affects multiple versions starting from 2.16.0 where the maxNameLength constraint was introduced but not enforced in this parser. The vulnerability is tracked alongside a related Smile parser defect under the same vendor advisory.
A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-101204 is an out-of-bounds read vulnerability in FastStone Image Viewer up to version 8.3, specifically in the TGA Image Handler component of FSViewer.exe. This vulnerability can be triggered remotely and may lead to information disclosure or application instability. The vendor has not responded to the disclosure, and no patch or fix is currently available. The CVSS score is 5.3, indicating a medium severity level.
CVE-2026-101203 is a medium severity vulnerability in FastStone Image Viewer up to version 8.3. It involves an out-of-bounds write in an unknown function of the 1bpp RLE Decoder component. The vulnerability can be triggered remotely and requires user interaction. No vendor response or patch is currently available.
A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can lead to out-of-bounds write. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the function copy_msg_element of the component devdiscover Service. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Parser. This manipulation causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-101037 is a critical stack-based buffer overflow vulnerability in the parse_advertisement_frame function of the devdiscover Service component in FAST FAC1200R version 5.0_20201119_1.0.2. This vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. The exploit code has been publicly disclosed, but no vendor response or patch is currently available.
A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impacted element is the function get_alias_name of the component uhttpd. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-91777 is a high-severity vulnerability in FasterXML jackson-databind involving uncontrolled resource consumption (CWE-400). The flaw arises from inefficient handling of forward-reference completion for @JsonIdentityInfo object IDs, causing quadratic CPU usage during deserialization when processing attacker-controlled JSON with unresolved object-ID references. This can lead to denial of service via excessive CPU consumption. The issue affects multiple jackson-databind versions from 2.5.0 through 3.2.2. No exploits are currently known in the wild.
CVE-2026-91776 is a high-severity vulnerability in FasterXML jackson-databind that causes uncontrolled resource consumption. It arises from caching fallback deserializers for unrecognized type IDs without bounds, allowing attackers to cause memory retention by supplying many distinct unknown type IDs. This affects applications using name-based polymorphism with a fallback and a long-lived ObjectMapper. The vulnerability impacts multiple jackson-databind versions up to 3.2.2.
CVE-2026-89425 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.8.0 through 3.2.2 in various subranges. The issue arises in UTF8DataInputJsonParser._reportInvalidToken(), which accumulates malformed token text without any upper bound, leading to excessive memory use. This can cause the Java Virtual Machine to run out of memory and crash due to unbounded StringBuilder growth when processing large malformed tokens via the DataInput parsing path.
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-89407 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.17.0 through 3.2.1 in specified subranges. It involves inefficient regular expression complexity in the NumberInput.looksLikeValidNumber() method, causing quadratic time complexity when processing certain numeric string inputs. This can lead to denial-of-service conditions by exhausting server resources during JSON deserialization of numeric types. The issue does not exist before version 2.17.0 and has been fixed by replacing the problematic regex with a single-pass scan.
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-68497 is a high-severity denial of service vulnerability in FasterXML jackson-databind affecting versions >=2.0.0 <2.18.10, >=2.19.0 <2.21.6, >=2.22.0 <2.22.2, >=3.0.0 <3.1.6, and >=3.2.0 <3.2.2. It arises because the library deserializes JSON strings bound to javax.xml.datatype.Duration or XMLGregorianCalendar fields by passing them directly to JDK factory methods that parse numeric components with O(n²) complexity, without enforcing length limits on the string input. This allows an unauthenticated attacker to cause excessive CPU consumption and denial of service by submitting a specially crafted JSON string with very long numeric components. No polymorphic typing or special configuration is required to trigger this issue.
A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.