CLEANSTART-2026-CO30211 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4633-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4633-1 advisory. - CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage...

Unity Linux 20.1070a Security Update: grafana-pcp (UTSA-2026-130110)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130110 advisory. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-110871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic...

PT-2026-114150

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http response recv that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized...

Rocky Linux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1791984617)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791984617 advisory. - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw...

Rocky Linux 9 [CIQ] Security Update: pki-jackson-core / pki-jackson-databind / etc (crlsa-2026_80504)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680504 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130146)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130146 advisory. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. Tenable has extracte...

CVE-2026-110836: Loop with Unreachable Exit Condition

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in httpresponserecv that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized...

PT-2026-114398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the reset per cpu data function within the drop monitor component. The issue occurs because the variable al includes the size of the struct nlattr a 4-by...

PT-2026-114170

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the re actor epoch pattern used by parse actor and date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid...

CVE-2026-110261: Inefficient Algorithmic Complexity

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...

CVE-2025-26466-msf

CVE-2025-26466 Metasploit module OpenSSH versions 9.5p1 to 9.9p1 is vulnerable to a memory and CPU exhaustion DoS Attack by sending repeated SSH2MSGPING packets type 192. This occurs before authentication, and can result in server lockup due to poor queue/buffer handling. More information about...

GHSA-2FMV-RV2C-59X7 Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows,...

Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows,...

GHSA-846F-F764-76MX Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignedCms.CheckSignature can...

Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignedCms.CheckSignature can...

GHSA-57XR-HFXX-JW5X Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Incrementally arriving form...

Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Incrementally arriving form...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the...