PT-2026-65779

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky s media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import sidebars function passing user-supplied URLs from imported JSON data to file get contents...

PT-2026-65839

Name of the Vulnerable Software and Affected Versions Infor Global HR version 11.24.10.01.33 Description An Insecure Direct Object Reference IDOR exists in the Employee Compensation View function. This allows unauthorized attackers to view the compensation information of other employees by sendin...

ROS-20260729-73-0004

The vulnerability in python-PyPDF2 is related to unlimited resource distribution. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260729-73-0030

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Linux kernel timer Heap Buffer Overflow DoS

The vulnerability of the trytodeltimersync function in the kernel/time/timer.c module of the Linux timer subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260729-73-0012

The vulnerability of the Exim mail server is related to the lack of initialization of resources. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and accessibility of the protected information...

Linux SCSI Host Busy Buffer Overflow DoS

The vulnerability of the scsihostbusy function in the drivers/scsi/hosts.c module of the Linux SCSI device driver framework is related to improper initialization of resources. Exploiting this vulnerability could allow an attacker to cause service failures...

Linux fs/binfmt_misc Heap Buffer Overflow DoS

The vulnerability of the bmregisterwrite function in the fs/binfmtmisc.c file of the Linux kernel file system allows for the exploitation of resources after their valid duration has ended. Exploiting this vulnerability can enable a hacker to cause service failures...

CVE-2026-14981 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits...

CVE-2026-14981

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits...

CVE-2026-14981

CVE-2026-14981 affects IBM WebSphere Application Server (versions 9.0; 8.5) and IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7). The issue is a denial-of-service in the HTTP channel caused by unbounded allocation of resources without limits. CVSS 3.1 base score 7.5 (HIGH) wit...

EUVD-2026-49992

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

EUVD-2026-49846

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...

Improper Authorization

OpenClaw is vulnerable to Improper Authorization. The vulnerability is due to insufficient enforcement of network access policies in the sandbox exec-server, allowing lower-trust callers to bypass configured restrictions and send HTTP requests to internal network resources that should be...

XWiki DeleteApplication - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through 17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack...

CVE-2026-55968

A flaw was found in Apache Thrift Node.js bindings. This vulnerability, stemming from inefficient algorithmic complexity and the allocation of resources without proper limits or throttling, allows a remote attacker to cause a Denial of Service DoS. By exploiting this, an attacker can consume...

CVE-2026-50135

A flaw was found in Hugo, a static site generator. A regression in the resources.Get function caused it to follow symbolic links symlinks, which are special files that point to other files or directories. This vulnerability allows an attacker who can place a symlink within a local mount point, su...

CVE-2026-65624: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...

ROS-20260728-73-0011

The vulnerability in Grafana is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC or WebFlux CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846. Spring MVC is used as part of our microservices. These vulnerabilities have been addressed. Please read the detail...