CVE-2026-66080: Allocation of Resources Without Limits or Throttling

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-77422: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

Linux Distros Unpatched Vulnerability : CVE-2026-61629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in...

SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:4286-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4286-1 advisory. - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278681 - CVE-2026-56855:...

Linux Distros Unpatched Vulnerability : CVE-2026-91777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for ever...

RHCOS 4 : OpenShift Container Platform 4.19.48 (RHSA-2026:68534)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68534 advisory. - net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 - encoding/asn1: golang: Go...

CVE-2026-19888: NULL Pointer Dereference

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

CVE-2026-95844: Uncontrolled Recursion

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a...

CVE-2026-95842: Uncaught Exception

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions,...

CVE-2026-96273: Improper Cleanup on Thrown Exception

Ghidra before 12.1.4 fails to validate the TYPECOL byte in OptionsDB.createUnregisteredOption, causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and...

Linux Distros Unpatched Vulnerability : CVE-2026-91018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

CVE-2026-59990: Allocation of Resources Without Limits or Throttling

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

CVE-2026-67220: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, addbinding/3 reads the rjmserlangselector argument and passes it through erlscan:string/1 then erlparse:parseterm/1. erlscan:string/1 intern...

apr-util security update

1.6.1-9.1 - Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 - Resolves: RHEL-236267 - apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client CVE-2026-34502 - Resolves...

CVE-2026-86065: Allocation of Resources Without Limits or Throttling

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has n...

CVE-2026-77420: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

CVE-2026-96609: Allocation of Resources Without Limits or Throttling

Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fil...

CVE-2026-77791: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-92001: Improper Restriction of Recursive Entity References in DTDs

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

Linux Distros Unpatched Vulnerability : CVE-2026-91776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based...