Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in brace-expansion

Summary IBM Watson Discovery Cartridge affected by vulnerability in brace-expansion Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive...

EUVD-2026-79192

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...

CVE-2026-90816

A flaw was found in FFmpeg. A CPU exhaustion issue can occur in the HLS protocol module when handling a specially crafted HLS HTTP Live Streaming playlist due to insufficient validation of duration or targetduration parameters. This vulnerability can lead to an excessive consumption of CPU...

CVE-2026-53941 Inspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.27.0 until 0.53.1, the uprobe library resolver can allow an unprivileged container to consume excessive CPU and block other containers from starting...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (Java CPU August 2026)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

UBUNTU-CVE-2026-91952

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

CVE-2026-91952

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

CVE-2026-91952

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

rabbitmq-server: rabbitmq-server: Denial of Service via consecutive wildcards in topic binding keys

A flaw was found in RabbitMQ. An authenticated remote user with permissions to bind queues to a topic exchange and publish messages can cause a Denial of Service DoS. By supplying consecutive wildcard characters within a topic binding key, the message routing engine redundantly evaluates matching...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-66046

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts function, causing excessive CPU consumption and a denial of service Mitigation To mitigate, avoid parsing...

SUSE CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

PT-2026-92187

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web url read in src/index.ts passes a caller-supplied URL to readUrlContent in src/url-reader.ts, where checkContentLength treats a missing Content-Leng...

CVE-2026-53941: Allocation of Resources Without Limits or Throttling

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.27.0 until 0.53.1, the uprobe library resolver can allow an unprivileged container to consume excessive CPU and block other containers from starting...

SUSE SLES15 Security Update : python-sqlparse (SUSE-SU-2026:4109-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4109-1 advisory. This update for python-sqlparse fixes the following issue: - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU...

rsync: rsync: Denial of Service via Algorithmic Complexity

A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the hashsearch function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service DoS...

rsync: rsync: Denial of Service via Algorithmic Complexity

A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the hashsearch function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service DoS...

CVE-2026-49250

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...