CVE Notifier

CVE-2026-93688 CWE-770 7.5

SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the…

cve.org sgl-project:sglang 1 hari lalu

CVE-2026-93687 CWE-674 7.5

braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and …

cve.org micromatch:braces 1 hari lalu

CVE-2026-7006 CWE-494 7.3

Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism

Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with ele…

cve.org Sublime · HQ · Pty 1 hari lalu

CVE-2026-93685 CWE-200 5.4

Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the dis…

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-93506 CWE-918 6.3

SveltyCMS File Upload Endpoint upload-media server-side request forgery

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side…

cve.org n/a:SveltyCMS 1 hari lalu

CVE-2026-93573 CWE-444 6.5

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last …

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-93652 CWE-190 7.5

Integer Overflow or Wraparound in µD3TN

Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS

cve.org D3TN · GmbH:µD3TN 1 hari lalu

CVE-2026-93568 CWE-20 7.5

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these reque…

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2025-13882 CWE-799 5.3

Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthe…

cve.org IBM:Sterling · Partner · Engagement 1 hari lalu

CVE-2026-93576 CWE-93 7.5

Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untruste…

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2025-1350 CWE-209 5.3

Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information c…

cve.org IBM:Controller 1 hari lalu

CVE-2026-16515 CWE-406 4.7

ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack

net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with an ICMPv6 error). It did not check whether the triggering pac…

cve.org zephyrproject:zephyr 1 hari lalu