CVE-2026-91828 OMGF < 6.3.11 - Unauthenticated DoS via do_optimize

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

CVE-2026-91828 OMGF < 6.3.11 - Unauthenticated DoS via do_optimize

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

EUVD-2026-91191

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire si...

CVE-2026-91828

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin (versions before 6.3.11 ) is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because the plugin fails to require authentication or a valid nonce for an action that triggers a slow server-side l...

CVE-2026-56449

A flaw was found in the modproxyhtml module of Apache HTTP Server. An attacker who controls or manipulates HTTP response bodies processed by the proxy can trigger an out-of-bounds memory write. This issue can cause the server process to crash, resulting in a Denial of Service DoS. Mitigation...

CVE-2026-42528

A flaw was found in the moddav module of the Apache HTTP Server. This vulnerability allows a Denial of Service DoS by crashing server child processes. An attacker with permission to create Web Distributed Authoring and Versioning WebDAV locks can trigger a memory calculation error during lock...

CVE-2026-59685

A flaw was found in httpd. When deployed on Windows environments, an out-of-bounds write vulnerability occurs while processing path requests containing short 8.3 file names that expand beyond allocated memory buffers. A remote attacker can exploit this flaw by sending crafted HTTP requests,...

CVE-2026-56153

A flaw was found in httpd's modcharsetlite module. A heap-based buffer overflow an out-of-bounds memory write occurs in the finishpartialchar function when handling character set conversions. A remote attacker can exploit this flaw by sending specially crafted requests, leading to memory...

CVE-2026-46729

A flaw was found in the modheartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attack...

CVE-2026-104182

A flaw was found in stream-json. A local attacker can cause a Denial of Service DoS by providing JSON with Comments JSONC input containing large comments split across multiple small chunks. The parser repeatedly rescans accumulated comment data from the beginning for each chunk, leading to...

CLEANSTART-2026-MV50731 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the consul package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...

CLEANSTART-2026-YZ71204 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the consul package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

CLEANSTART-2026-SD77864 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

Security vulnerability affects the consul package. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop...

EUVD-2026-91134

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

EUVD-2026-91076

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed...

SUSE CVE-2026-98081

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

SUSE CVE-2026-98088

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

PT-2026-104240

Zebra zebrad 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportiona...

ROS-20261002-73-0042

The vulnerability of the PostgreSQL database management system is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure...

pbkdf2 library DoS

The vulnerability in the lib/sync.js script of the pbkdf2 library on the Node.js software platform involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...