OESA-2026-3338 open-iscsi security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files...

OESA-2026-3332 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

CVE-2026-60075

A flaw was found in Date::Manip for Perl. An attacker could exploit a vulnerability in the parsetime function by providing a specially crafted input string containing long sequences of whitespace. This could lead to excessive CPU consumption due to inefficient processing, resulting in a Denial of...

MINI-CVGM-HGHM-566M

Bulletin has no description...

Denial-of-service (DoS)

Spring Cloud Sleuth is vulnerable to a Denial-of-service DoS. The vulnerability is due to specially crafted calls that can trigger a DoS condition when org.springframework.cloud:spring-cloud-sleuth-instrumentation is used with Spring TX instrumentation enabled, allowing an attacker to exploit the...

CLEANSTART-2026-NI09803 Security fixes in metrics-server 0.8.1-r5

Package metrics-server version 0.8.1-r5 fixes 6 vulnerabilities: CVE-2026-42154, CVE-2026-42151, CVE-2026-44903, ghsa-wg65-39gg-5wfj, ghsa-fw8g-cg8f-9j28...

CLEANSTART-2026-ZO84411 Security fixes in prometheus-alertmanager 0.26.0-r0

Package prometheus-alertmanager version 0.26.0-r0 fixes 1 vulnerabilities: CVE-2023-40577...

CLEANSTART-2026-OD61763 Security fixes in boring-registry-fips 0.15.5-r2

Package boring-registry-fips version 0.15.5-r2 fixes 2 vulnerabilities: CVE-2025-30204, ghsa-mh63-6h87-95cp...

bind9: bind: Potential wildcard CNAME RPZ policy bypass

A flaw was found in BIND 9, a widely used Domain Name System DNS software. A remote attacker could exploit this by sending specially crafted, excessively long DNS queries. This could bypass Response Policy Zone RPZ rules, which are designed to block access to malicious domains, and potentially...

bind: bind9: Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

CVE-2026-73621

GitPython vulnerability CVE-2026-73621 affects GitPython before 3.1.56. The Commit.count() method forwards keyword arguments to git rev-list without the check_unsafe_options guard present in iter_items, allowing an attacker who controls options (e.g., via an app forwarding a user-supplied dict) t...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind: bind9: Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

Kibana 8.19.20, and 9.4.4 Security Update (ESA-2026-90)

Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations Description: Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities

Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION:...

CVE-2026-19484

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results

A flaw was found in Browserslist, a configuration tool for front-end development. An attacker can exploit this vulnerability by influencing repeated query values, leading to unbounded memory growth. This issue can cause the application to consume excessive memory, resulting in an out-of-memory...

Denial Of Service (DoS)

Apache ActiveMQ is vulnerable to a Memory Allocation with Excessive Size Value vulnerability. The vulnerability is due to improper handling of non-terminating STOMP header bytes, which allows an unauthenticated attacker to send an excessive amount of header data over a STOMP NIO connection, causi...

CVE-2026-14298

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713...

Memory Allocation With Excessive Size Value

Apache ActiveMQ is vulnerable to Memory Allocation with Excessive Size Value. The vulnerability is due to improper validation of the encoded size of OpenWire message property maps during unmarshaling, which allows an authenticated attacker to send a crafted message with an excessively large size...