CVE-2026-74797 OpenTofu before 1.11.4 Denial of Service via malicious zip

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74797

OpenTofu before 1.11.4 is affected by a denial-of-service vulnerability in the tofu init command when handling maliciously crafted .zip archives for provider or module packages. Processing such archives can trigger excessive CPU usage during dependency installation, degrading system performance a...

CVE-2026-74797

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74785

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

CVE-2026-73060

Scriban versions 3.0.0–7.2.5 have a denial-of-service vulnerability in ScriptRange.Multiply where the left operand is a lazy sequence, bypassing LoopLimit. Attackers can craft templates that multiply arrays on lazy sequences to trigger billions of uncharged iterations, pinning CPU cores and exhau...

CVE-2026-73060 Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged...

EUVD-2026-59946

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged...

CVE-2026-73060

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged...

CVE-2026-73060 Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged...

CLSA-2026-1786881091 Fix CVE(s): CVE-2026-1519

SECURITY UPDATE: excessive NSEC3 iterations CPU denial of service during insecure delegation validation - debian/patches/CVE-2026-1519.patch: cap NSEC3 iterations at DNSNSEC3MAXITERATIONS 150 in isdelegation and skip already-trusted rdatasets during the insecurity proof, and require dnstrustsecur...

Exploit for CVE-2026-73633

CVE-2026-73633 Apache Struts S2-072 — PoC + Environment...

CVE-2026-74797: Uncontrolled Resource Consumption

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation,...

CVE-2026-74785: Uncontrolled Resource Consumption

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attacker...

PT-2026-73147

Name of the Vulnerable Software and Affected Versions Scriban versions 3.0.0 through 7.2.5 Description A denial of service issue exists in the ScriptRange.Multiply operator. When the left operand is a lazy sequence, the LoopLimit is bypassed, allowing attackers to provide templates with array...

CVE-2026-74767

Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...

CVE-2026-74551 hwmon: (nzxt-smart2) DMA-align output buffer

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...

CVE-2026-74504

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

Exploit for CVE-2026-73633

CVE-2026-73633 Apache Struts S2-072 — PoC + Environment...

UBUNTU-CVE-2026-74286

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-72067

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...