CVE-2026-48802

A flaw was found in python-engineio, a Python implementation of the Engine.IO realtime client and server. A remote attacker can exploit a vulnerability in the heartbeat mechanism by sending specific packets, leading to the creation of excessive background threads. This can result in a Denial of...

libheif-cve-2026-50142

CVE-2026-50142 — libheif Asignación de heap ilimitada en el analizador de secuencias HEIF modo de tamaño fijo stsz Gravedad: Alta CVSS 7.5 Aviso: GHSA-jvmp-j3cw-84mh Corregido: commit a6caa38 por @farindk Tiempo para corregir: 1 hora Resumen Un archivo HEIF manipulado de 1.477 bytes desencadena u...

cve-2015-5477

cve-2015-5477 PoC para DoS por aserción TKEY en BIND9 CVE-2015-5477 root@kitploit: $ ps awux | grep -v grep | grep bind bind 2373 0.0 2.2 141164 13424 ? Ssl 14:58 0:00 /var/named/chroot/sbin/named -u bind -t /var/named/chroot -c /etc/named.conf $ python tkill.py 127.0.0.1 Begin emission: ..Finish...

patch-manual-CVE-2025-26465-e-CVE-2025-26466

🛡️ Manual Mitigation - OpenSSH CVE-2025-26465 & CVE-2025-26466 🔍 About the Script This script applies manual mitigations for security issues in OpenSSH , without the need for immediate update. 🚨 CVE-2025-26465 Removes VerifyHostKeyDNS to prevent SSH connection interception. 🚨 CVE-2025-26466 Adjust...

kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...

CVE-2026-90990

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk 2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-90990

Checkmk versions prior to 2.5.0p14 are affected by improper neutralization of newlines in filter values within the monitoring host and service list APIs . An authenticated user can inject additional Livestatus query headers, enabling them to bypass object visibility restrictions in count queries ...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

Security Bulletin: Due to the use of Apache ActiveMQ All, IBM Sterling Control Center is vulnerable to Improper Authorization and Improper Input Validation (CVE-2026-59878, CVE-2026-61487)

Summary Apache ActiveMQ All is used by IBM Sterling Control Center as part of dependency in activemq-all-5.19.0.jar. Vulnerability Details CVEID:CVE-2026-59878 DESCRIPTION: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote...

CVE-2026-28318-check

SolarWinds Serv-U DoS no autenticado: Script de detección seguro Un detector seguro, no destructivo para CVE-2026-28318 , una denegación de servicio no autenticada en SolarWinds Serv-U= 15.5.4.108. Una única POST que lleva Content-Encoding: deflate y un cuerpo alimenta ese cuerpo a un descompreso...

CVE-2026-95508

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting ...

kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...

kernel: netfilter: conntrack: remove sprintf usage

A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of sprintf and insufficient buffer sizing in the manglecontentlen function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue t...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.34 packages and security update

Red Hat OpenShift Container Platform release 4.21.34 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

CVE-2026-65634

CVE-2026-65634 is a quadratic-complexity CPU denial-of-service vulnerability in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder. The root cause is that asn1rtt_ber:dec_subidentifiers/3, asn1rtt_per_common:dec_subidentifiers/3, and asn1rtt_jer:json2oid/1 accumulate a base-128 subidentifier into an u...

CVE-2026-65634 Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

CVE-2026-65634 Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

CVE-2026-68956 SSH daemon allocates unbounded idle session channels, bypassing max_channels

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...