CVE-2026-14801

GPAC TeXML File load_text.c txtin_probe_duration divide by zero

A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g80071f700-master. The impacted element is the function txtin_probe_duration of the file src/filters/load_text.c of the component TeXML File Handler. Such manipulation of the argument txml_timescale leads to divide by zero. An attack has to be approached locally. The name of the patch is 86a5191f2e750c767253e27ed6cfd6d547afebc2. A patch should be applied to remediate this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2026-12575

DVP80ES3 Improper Resource Shutdown or Release Vulnerability

DVP80ES3 with  Improper Resource Shutdown or Release vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Deltaww

Products

Dvp80es3

CVE-2026-38641

Denial of Service via Malformed Shared Library in Redox OS relibc

An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via loading a crafted shared library.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redox-os

Products

Relibc

CVE-2026-13523

GPAC ISOBMFF base_encoding.c data amplification

A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 297f2d8d1f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2026-13491

78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service

A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

78

Products

Xiaozhi-esp32

CVE-2026-2903

skvadrik re2c ast.cc check_and_merge_special_rules null pointer dereference

A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack can only be executed locally. The exploit has been published and may be used. Patch name: febeb977936f9519a25d9fbd10ff8256358cdb97. It is suggested to install a patch to address this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Re2c Skvadrik

Products

Re2c Re2c

CVE-2026-54280

AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Aio-libs Aiohttp

Products

Aiohttp Aiohttp

CVE-2025-24160

File Parsing Crash causing Application Denial of Service

The issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Parsing a file may lead to an unexpected app termination.

CVSS 3.1 · 4.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 3 more

CVE-2026-3206

Improper management of context cancelations

Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules). This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Krakend

Products

Krakend-ce Krakend-ee

CVE-2024-0886

Poikosoft EZ CD Audio Converter Activation denial of service

A vulnerability classified as problematic was found in Poikosoft EZ CD Audio Converter 8.0.7. Affected by this vulnerability is an unknown functionality of the component Activation Handler. The manipulation of the argument Key leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-252037 was assigned to this vulnerability.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Poikosoft

Products

Ez Cd Audio Converter

CVE-2024-0695

EFS Easy Chat Server HTTP GET Request denial of service

A vulnerability, which was classified as problematic, has been found in EFS Easy Chat Server 3.1. Affected by this issue is some unknown functionality of the component HTTP GET Request Handler. The manipulation of the argument USERNAME leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251480. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Easy Chat Server Project

Products

Easy Chat Server

CVE-2022-3551

X.org Server xkb.c ProcXkbGetKbdByName memory leak

A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.

CVSS 3.1 · 3.5 Low EPSS 2.4% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2022-3544

Linux Kernel Netfilter sysfs.c damon_sysfs_add_target memory leak

A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211044.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2022-3533

Linux Kernel BPF usdt.c parse_usdt_arg memory leak

A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2022-3354

Open5GS UDP Packet ogs-tlv-msg.c denial of service

A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-209686 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs

CVE-2022-2776

SourceCodester Gym Management System delete_user.php denial of service

A vulnerability classified as problematic has been found in SourceCodester Gym Management System. Affected is an unknown function of the file delete_user.php. The manipulation of the argument delete_user leads to denial of service. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-206172.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gym Management System Project

Products

Gym Management System

CVE-2022-23634

Information Exposure when using Puma with Rails

Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

CVSS 3.1 · 8 High EPSS 2.1% KEV · Not listed

Vendors

Debian Fedoraproject Puma and 2 more

Products

Debian Linux Fedora Puma and 2 more

CVE-2026-11317

Rockwell Automation Logix 5370 and 5570 Controllers Vulnerable To Denial of Service Via CIP

A denial of service security issue exists in the affected product. The security issue stems from a fault occurring when a crafted CIP message is sent. Devices with less memory are more likely to be affected. This can result in a major nonrecoverable fault (MNRF). A program download is required to recover.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Compactlogix Controllogix

CVE-2026-9358

postcss-selector-parser AST Serialization container.js toString recursion

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)." The commits were backported to 6.x branch, which was the most downloaded version.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Postcss Postcss-selector-parser

Products

Postcss Postcss-selector-parser

CVE-2026-45174

Idira Endpoint Privilege Manager Linux Agent: Potential bypass of Agent Daemon Initialization

Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization. CyberArk Security Bulletin: CA26-19

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Cyberark Cyberark Software A Palo Alto Networks Company Linux and 1 more

Products

Endpoint Privileged Manager Idira Endpoint Privilege Manager Linux Kernel and 1 more