CVE-2013-2094

kernel: perf_swevent_enabled array out-of-bound access

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

CVSS 3.1 · 8.4 High EPSS 47.7% KEV · Listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2025-8194

Tarfile infinite loop during parsing with negative member offset

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Python

Products

Cpython

CVE-2026-32287

Infinite loop in github.com/antchfx/xpath

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Antchfx

Products

Xpath

CVE-2026-33904

Ella Core has a Denial of Service via SCTP connection cleanup deadlock

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers. Version 1.7.0 adds deferred Radio cleanup in serveConn SCTP server so that every connection exit path removes the radio. Remove the stale-entry scan from SCTP Notification handling.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ellanetworks

Products

Core Ella Core

CVE-2026-23516

CVAT vulnerable to XSS via skeleton SVG images

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cvat Cvat-ai

Products

Computer Vision Annotation Tool Cvat

CVE-2026-24803

A possible infinite loop vulnerability in coolsnowwolf/lede

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7615d/src/mt_wifi/embedded/security modules). This vulnerability is associated with program files bn_lib.C. This issue affects lede: through r25.10.1.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Coolsnowwolf

Products

Lede

CVE-2026-2739

bn.js: bn.js: Denial of Service via calling maskn(0)

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Indutny

Products

Bn.js

CVE-2026-24485

ImageMagick: Infinite loop vulnerability when parsing a PCD file

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dlemstra Imagemagick

Products

Magick.net Imagemagick

CVE-2026-23082

can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error

In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup. However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty. To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-21507

iccDEV is Vulnerable to Denial of Service via Infinite Loop in CalcProfileID()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have an infinite loop in the IccProfile.cpp function, CalcProfileID. This issue is fixed in version 2.3.1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Color Internationalcolorconsortium

Products

Iccdev Iccdev

CVE-2026-0960

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-21905

Junos OS: SRX Series, MX Series with MX-SPC3 or MS-MPC: Receipt of multiple specific SIP messages results in flow management process crash

A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the SIP application layer gateway (ALG) of Juniper Networks Junos OS on SRX Series and MX Series with MX-SPC3 or MS-MPC allows an unauthenticated network-based attacker sending specific SIP messages over TCP to crash the flow management process, leading to a Denial of Service (DoS). On SRX Series, and MX Series with MX-SPC3 or MS-MPC service cards, receipt of multiple SIP messages causes the SIP headers to be parsed incorrectly, eventually causing a continuous loop and leading to a watchdog timer expiration, crashing the flowd process on SRX Series and MX Series with MX-SPC3, or mspmand process on MX Series with MS-MPC. This issue only occurs over TCP. SIP messages sent over UDP cannot trigger this issue. This issue affects Junos OS on SRX Series and MX Series with MX-SPC3 and MS-MPC: * all versions before 21.2R3-S10,  * from 21.4 before 21.4R3-S12,  * from 22.4 before 22.4R3-S8,  * from 23.2 before 23.2R2-S5,  * from 23.4 before 23.4R2-S6,  * from 24.2 before 24.2R2-S3,  * from 24.4 before 24.4R2-S1,  * from 25.2 before 25.2R1-S1, 25.2R2.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Juniper Juniper Networks

Products

Junos Mx10004 Mx10008 and 26 more

CVE-2026-23874

ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-13 have a stack overflow via infinite recursion in MSL (Magick Scripting Language) `<write>` command when writing to MSL format. Version 7.1.2-13 fixes the issue.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-22849

Saleor lacks proper HTML sanitization in rich text fields

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Saleor

Products

Saleor

CVE-2026-24802

Buffer Overflow Vulnerability in briandilley/jsonrpc4j

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java. This issue affects jsonrpc4j: through 1.6.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Briandilley

Products

Jsonrpc4j

CVE-2026-24804

A infinite loop vulnerability in coolsnowwolf/lede

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7603e/src/mt7603_wifi/common modules). This vulnerability is associated with program files bn_lib.C. This issue affects lede: through r25.10.1.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Coolsnowwolf

Products

Lede

CVE-2026-24816

Cookie Security Vulnerabilities in datavane/tis

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in datavane tis (tis-console/src/main/java/com/qlangtech/tis/runtime/module/action modules). This vulnerability is associated with program files ChangeDomainAction.Java. This issue affects tis: before v4.3.0.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Datavane

Products

Tis

CVE-2026-24831

Infinite loop (DoS) in ixray-1.6-stcop

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ixray-team

Products

Ix-ray Engine 1.6 Ixray

CVE-2026-23109

fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()

In the Linux kernel, the following vulnerability has been resolved: fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes() Above the while() loop in wait_sb_inodes(), we document that we must wait for all pages under writeback for data integrity. Consequently, if a mapping, like fuse, traditionally does not have data integrity semantics, there is no need to wait at all; we can simply skip these inodes. This restores fuse back to prior behavior where syncs are no-ops. This fixes a user regression where if a system is running a faulty fuse server that does not reply to issued write requests, this causes wait_sb_inodes() to wait forever.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-25533

Enclave has a sandbox escape via infinite recursion and error objects

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references. This vulnerability is fixed in 2.10.1.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Agentfront

Products

Enclave