DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector...

DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.12.2, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector o...

DoS (Denial of Service) at org.apache.tomcat:tomcat-coyote Dependency in Bamboo Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Authorization (CVE-2026-33186)

Summary There are vulnerabilities in google.golang.org/grpc-v1.78.0 used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33186. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-33186 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Versions pri...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 11 and 5.4.0 before Patch 6. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN...

curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections

A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service...

tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation

A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication SNI validation. This could potentially lead to unauthorized access or misrouting of reques...

tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...

CVE-2026-80748 mmc: loongson2: Fix sg iteration in data reorder functions

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...

Security update for kubevirt, virt-pr-helper-container

This update for kubevirt, virt-pr-helper-container fixes the following issues: Changes in kubevirt: Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into place...

SUSE-SU-2026:3955-1 Security update for kubevirt, virt-pr-helper-container

This update for kubevirt, virt-pr-helper-container fixes the following issues: Changes in kubevirt: - Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into plac...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

SUSE CVE-2026-81722

nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...

SUSE CVE-2026-84304

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

PT-2026-90826

This update for kubevirt, virt-pr-helper-container fixes the following issues: Changes in kubevirt: - Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into plac...

AlmaLinux 8 : nodejs:24 (ALSA-2026:62583)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62583 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

TencentOS Server 2: dracut (TSSA-2026:0970)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0970 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

RockyLinux 10 : nodejs22 (RLSA-2026:61376)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61376 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

Oracle Linux 9 : nginx:1.24 (ELSA-2026-59490)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59490 advisory. - Resolves: RHEL-219310 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 - Resolves: RHEL-217962 -...

libcurl 7.44.0 < 8.22.0 HTTP/2 Server Push Use-After-Free

The version of libcurl installed on the remote host is 7.44.0 prior to 8.22.0. It is, therefore, affected by a use-after-free vulnerability: - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to...