CVE-2026-63133

Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cisagov

Products

Malcolm

CVE-2026-85532

Apache WSS4J: Insufficient Validation of Derived-Key Parameters

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Wss4j

CVE-2026-95275

chromium-browser: Incorrect reference resolution in MediaStream

Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-17523

can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet

In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet This patch switches the timer to HRTIMER_MODE_SOFT, which executed the timer callback in softirq context and removes the hrtimer_tasklet.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2026-95326

chromium-browser: Incomplete cleanup in Bluetooth

Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95314

chromium-browser: Incorrect authorization in HID

Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-64008

accel/rocket: fix UAF via dangling GEM handle in create_bo

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctl_create_bo() inserts a GEM handle into the file's IDR via drm_gem_handle_create() early on, then performs several operations that can fail (sgt allocation, drm_mm insert, iommu_map). If any fail after the handle is live, the error path calls drm_gem_shmem_object_free() which kfree's the object without removing the handle from the IDR. This leaves a dangling handle pointing to freed slab memory. Any subsequent ioctl using that handle (PREP_BO, FINI_BO, SUBMIT) calls drm_gem_object_lookup() and dereferences freed memory (UAF). Fix by moving drm_gem_handle_create() to after all fallible operations succeed, matching the pattern used by panfrost, lima, and etnaviv. Also fix drm_mm_insert_node_generic() whose return value was silently overwritten by iommu_map_sgtable() on the next line. Add the missing error check. [tomeu: Move handle creation to the very end]

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-95303

chromium-browser: Incomplete cleanup in SmartCard

Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95285

chromium-browser: Missing authorization in WebView

Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-95278

chromium-browser: Missing authorization in WakeLock

Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-63973

net: mana: Add NULL guards in teardown path to prevent panic on attach failure

In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as mana_remove(), mana_change_mtu() recovery, and internal error handling in mana_alloc_queues() can subsequently call into functions that dereference these pointers without NULL checks: - mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26). - mana_destroy_vport() iterates apc->rxqs without a NULL check. - mana_fence_rqs() iterates apc->rxqs without a NULL check. - mana_dealloc_queues() iterates apc->tx_qp without a NULL check. Add NULL guards for apc->rxqs in mana_fence_rqs(), mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue draining when TX queues were never allocated or already freed.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-63972

net: mana: Skip redundant detach on already-detached port

In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When mana_per_port_queue_reset_work_handler() runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc->tx_qp and apc->rxqs already freed. Calling mana_detach() again unconditionally leads to NULL pointer dereferences during queue teardown. Add an early exit in mana_detach() when the port is already in detached state (!netif_device_present) for non-close callers, making it safe to call idempotently. This allows the queue reset handler and other recovery paths to simply retry mana_attach() without redundant teardown.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-71486

vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts structures are processed by OnlineDerenderer and tokenizer.decode before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-73555

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-93698

Arbitrary Command Execution via Multilang Adminbin Vulnerability

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

CVSS 3.0 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Webpros

Products

Cpanel Wp Squared

CVE-2026-93697

Stored XSS Allowing Arbitrary Code Execution in WHM Mass Modify Accounts

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

CVSS 3.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Webpros

Products

Cpanel Wp Squared

CVE-2026-71452

OS Command Injection in Johnson Controls EasyIO FS32 Prior to 3.0b63

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easyio Fs32

CVE-2026-71451

OS Command Injection in Johnson Controls EasyIO FS32

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easyio Fs32

CVE-2026-71449

Hard‑coded Cryptographic Key Enables Retrieval of Embedded Sensitive Data in Johnson Controls EasyIO FS32

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easyio Fs32

CVE-2026-27874

Hard‑coded Credentials Vulnerability in Johnson Controls EasyIO FS32

: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects EasyIO FS32: before 3.0b63.

CVSS 4.0 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easyio Fs32