Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
804 results · page 3 of 17
Sep 8, 2026Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-69304 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Product
- .NET 10.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files.CVE-2025-15614 · Other software · Genivia · reported by VulnCheckMedium 4.8
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
- Product
- ugrep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN: Remote Code ExecutionCVE-2026-83627 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be crea
- Product
- Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN
- Affected
- up to 3.21.0
- What to do
- Affects up to 3.21.0. Update Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2026Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed CVE-2026-85786 · Other software · Amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.
- Product
- ion-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Sep 4, 2026undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header.CVE-2026-84890 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.9
undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megabytes or more in client memory, an asymmetric resource consumption that can exhaust memory and crash the process. This affects undici versions from 7.15.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressor_lzma.c sizes the module-global MicrCVE-2026-80892 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream pool from num_possible_cpus() when the lzma_streams module parameter is unset, then z_erofs_load_lzma_config() preallocates one image-supplied dictionary per stream, accepting dictionaries up to 8 MiB. On high-CPU systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed decoder state until the erofs module is unloaded. Impact: An EROFS image mounted by the system can pin up to 8 MiB of vmalloc memory per LZMA stream, either as intended or unexpectedly. Bound the default stream count by a new CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the worst-case default preallocation is 128 MiB if the number of CPUs is no less than 16 while preserving the existing per-image dictionary limit. An explicit lzma_streams module parameter is still honoured as-is, so administrators who deliberately size the pool are not affected.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 3, 2026parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size.CVE-2026-82520 · Other software · domainaware · reported by VulnCheckHigh 8.7
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
- Product
- parsedmarc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.CVE-2026-84757 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
- Affected
- up to 7.21.28
- What to do
- Affects up to 7.21.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026A flaw was found in rpmuncompress.CVE-2026-84838 · Other software · Red Hat · reported by Red HatHigh 7.8
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 2, 2026Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130).CVE-2026-78594 · Other software · Elastic · reported by security@elastic.coMedium 4.9
Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.
- Product
- Apm Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130).CVE-2026-72628 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.CVE-2026-81285 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompreCVE-2026-58107 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfMedium 5.5
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.
- Product
- CodeChecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash.CVE-2026-73209 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.
- Product
- OX Dovecot Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.com
Aug 28, 2026An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, aCVE-2026-52687 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comMedium 6.5
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all connections it handles, which can cause degradation or denial of service for IMAP. Disable IMAP compression. Alternatively limit the number of connections handled by a single imap-login process, though this has a performance impact. Update to non-vulnerable version. No publicly available exploits are known.
- Product
- OX Dovecot Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.com
Aug 28, 2026When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail anCVE-2026-40203 · Other software · Open-Xchange GmbH · reported by security@open-xchange.comLow 3.7
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can confirm whether the body of a small message matches a guessed text. Recovery of arbitrary unknown content was not demonstrated, but the attack can disclose whether a secret-like message body matches a candidate. Disable IMAP compression. Update to non-vulnerable version. No publicly available exploits are known.
- Product
- OX Dovecot Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.open-xchange.com
Aug 28, 2026In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bCVE-2026-80631 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.5
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL folio from bio_next_folio(), and with CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults. BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simple_end_io_work kasan_report (mm/kasan/report.c:590) lzo_decompress_bio (fs/btrfs/lzo.c:383) end_bbio_compressed_read (fs/btrfs/compression.c:1065) btrfs_bio_end_io (fs/btrfs/bio.c:135) btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simple_end_io_work process_one_work worker_thread Reject any segment whose payload would extend beyond compressed_len before c
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 28, 2026In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress_lznt decompress_lznt() does not validate arrayCVE-2026-80598 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress_lznt decompress_lznt() does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read. Add index bounds checking to prevent the OOB access.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 27, 2026The UnZipTransformer does not limit decompressed entry size or entry count when processing archives.CVE-2026-59274 · Other software · Spring · reported by security@vmware.comMedium 6.5
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
- Product
- Spring Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.CVE-2026-47860 · Other software · Spring · reported by security@vmware.comMedium 6.5
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Product
- Spring AMQP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibCVE-2026-15310 · Other software · Python Software Foundation · reported by cna@python.orgLow 2.1
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio.CVE-2026-78206 · Other software · exceljs · reported by VulnCheckHigh 8.7
exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
- Product
- exceljs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1.CVE-2026-77640 · Other software · torproject · reported by MITRELow 3.7
tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the caller can abort cleanly. This is TROVE-2026-021.
- Product
- Tor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream deteCVE-2026-77639 · Other software · torproject · reported by MITREMedium 5.3
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.
- Product
- Tor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Tanium addressed a compression bomb vulnerability in Threat Response.CVE-2026-75476 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.1
Tanium addressed a compression bomb vulnerability in Threat Response.
- Product
- Threat Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Tanium addressed a compression bomb vulnerability in Findings.CVE-2026-11617 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.1
Tanium addressed a compression bomb vulnerability in Findings.
- Product
- Findings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial CVE-2026-75936 · Other software · Amazon Ion · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set an explicit withMaximumBufferSize() when parsing untrusted input.
- Product
- Amazon Ion Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Aug 18, 2026Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting containerCVE-2026-19671 · Other software · CISAgov · reported by ics-cert@hq.dhs.govHigh 7.1
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.
- Product
- Malcolm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations tCVE-2026-17106 · Other software · moby · reported by security@docker.comHigh 7.1
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
- Product
- go-archive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Aug 18, 2026Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peeCVE-2026-74046 · Other software · Wazuh · reported by VulnCheckMedium 6.9
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.
- Product
- wazuh-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.CVE-2026-73343 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026yawkat LZ4 Java provides LZ4 compression for Java.CVE-2026-59949 · Other software · yawkat · reported by GitHubMedium 6.5
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.
- Product
- lz4-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c).CVE-2026-12630 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgMedium 4.3
Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC dispatch word (iphc & NET_6LO_IPHC_DA_MASK, a 4-bit value of 0-15). The reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table. The iphc word is taken directly from the received frame, and get_ihpc_inlined_size() is reached on every inbound 6LoWPAN frame via net_6lo_uncompress() from the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee802154_6lo.c and ieee802154_6lo_fragment.c). An unauthenticated attacker on the radio/adjacent link can therefore craft a frame whose destination addressing-mode nibble selects an out-of-range index, with no privileges or user interaction. The out-of-bounds value becomes the computed inline_size, which then drives header reconstruction before the buffer-length check: it is used to dereference *(pkt->buffer->data + sizeof(iphc) + inline_size) and to compute a size_t diff that can underflow, leading to a furth
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpointCVE-2026-75047 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possibleCVE-2026-68762 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible
- Product
- Ktor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2026WP Compress – Instant Performance & Speed Optimization: Cross-Site Request ForgeryCVE-2026-17608 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Compress – Instant Performance & Speed Optimization
- Affected
- up to 7.10.09
- What to do
- Affects up to 7.10.09. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configuredCVE-2026-14298 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplCVE-2026-73325 · Other software · Fujitsu Research · reported by VulnCheckHigh 8.4
Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.
- Product
- OneCompression
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilegeCVE-2026-20913 · Other software · Intel · reported by secure@intel.comMedium 4.8
Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- Product
- Neural Compressor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an escalation of privilCVE-2026-20906 · Other software · Intel · reported by secure@intel.comMedium 5.4
Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- Product
- Neural Compressor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026CyberChef is a web app for encryption, encoding, compression, and data analysis.CVE-2026-72912 · Other software · gchq · reported by GitHubMedium 4.3
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.
- Product
- CyberChef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes [BUG] There is a syzbot report that thCVE-2026-68167 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes [BUG] There is a syzbot report that the check inside get_new_location() triggered: BTRFS info (device loop0): found 31 extents, stage: move data extents BTRFS info (device loop0): leaf 8908800 gen 16 total ptrs 28 free space 1676 owner 18446744073709551607 item 0 key (256 INODE_ITEM 0) itemoff 3835 itemsize 160 inode generation 5 transid 0 size 0 nbytes 0 block group 0 mode 40755 links 1 uid 0 gid 0 rdev 0 sequence 0 flags 0x0 atime 1669132761.0 ctime 1669132761.0 mtime 1669132761.0 otime 0.0 item 1 key (256 INODE_REF 256) itemoff 3823 itemsize 12 index 0 name_len 2 item 2 key (258 INODE_ITEM 0) itemoff 3663 itemsize 160 inode generation 1 transid 16 size 733184 nbytes 106496 block group 0 mode 100600 links 0 uid 0 gid 0 rdev 0 sequence 24 flags 0x18 item 3 key (258 EXTENT_DATA 0) itemoff 3595 itemsize 68 generation 16 ty
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 6, 2026Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attackCVE-2026-17264 · Other software · Medixant · reported by ics-cert@hq.dhs.govMedium 5.3
Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.
- Product
- RadiAnt DICOM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algoCVE-2026-70634 · Other software · timescale · reported by VulnCheckHigh 7.2
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover.
- Product
- timescaledb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows auCVE-2026-70633 · Other software · timescale · reported by VulnCheckHigh 7.1
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray. Attackers with DML access to a compressed hypertable can trigger an unsigned integer wraparound in the reverse iterator bucket index computation, causing a read beyond the end of the bucket array, resulting in a SIGSEGV crash that can be repeatedly triggered on each subsequent reverse-order scan.
- Product
- timescaledb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance CVE-2026-19027 · Other software · The HDF Group · reported by 0253b833-3e77-4dfe-9d57-17db1a2f0a74Medium 6.9
The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
- Product
- HDF5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2026FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and CVE-2026-67306 · Other software · FreeRDP · reported by VulnCheckMedium 5.3
FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15 attacker-declared raw bytes are read without validating that the source buffer contains them. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the source buffer. The issue is fixed in FreeRDP 3.29.0.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 20267-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2026-14266 · Other software · 7-Zip · reported by zdi-disclosures@trendmicro.comHigh 7.8
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
- Product
- 7-Zip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comopenwall.com
Jul 28, 2026Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.CVE-2026-66913 · Other software · lookyloo · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 6.9
Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable. The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted. The patch introduces: * A 1 GB cumulative uncompressed-size limit for imported capture archives. * Size-limited gzip and zlib decompression for compressed HAR files. * Explicit detection and handling of suspected zip bombs. * An HTTP 400 response when an oversized compressed HAR file is submitted through the API.
- Product
- lookyloo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings.CVE-2026-49158 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
- Product
- Apache Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.