PT-2026-76736

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description A Denial of Service DoS issue exists where a statement consisting of numerous single-line comments can cause quadratic CPU consumption. This occurs because the group comments function in...

PT-2026-76735

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description sqlparse contains a Regular Expression Denial of Service ReDoS issue where the lexer repeatedly scans unmatched dollar-quoted literals and multiline-comment delimiters. This occurs because the regex...

CVE-2026-59893: Inefficient Regular Expression Complexity

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-54284: Inefficient Algorithmic Complexity

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

PT-2026-73388

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability fo...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099970)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099970 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure resource...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100775)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100775 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure resource...

PT-2026-73369

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

PT-2026-73426

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

PT-2026-73428

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100544)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100544 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099960)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099960 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under certain circumstances, partia...

CVE-2026-74797

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74789

Scriban before 7.0.0 affected = 6.6.0 applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as 1..1000000 | array.size — or a memory-amplification expression such as '...

CVE-2026-74797

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74797

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74797 OpenTofu before 1.11.4 Denial of Service via malicious zip

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

EUVD-2026-59962

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74797 OpenTofu before 1.11.4 Denial of Service via malicious zip

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74797

OpenTofu before 1.11.4 is affected by a denial-of-service vulnerability in the tofu init command when handling maliciously crafted .zip archives for provider or module packages. Processing such archives can trigger excessive CPU usage during dependency installation, degrading system performance a...