CVE-2026-75575: Improper Restriction of Excessive Authentication Attempts

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

PT-2026-81864

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge path keeps the failure count as tries inside the totp pending record ...

PT-2026-81147

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

PT-2026-81274

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.27.0 Description The software fails to properly classify DeepStream as a GPU backend, which leads to the omission of pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream during ...

CVE-2026-76098

Mistune (Python Markdown parser) versions 3.3.0 through 3.3.2 are vulnerable to Denial of Service via deeply nested emphasis tokens. When HTML rendering processes consecutive asterisk characters, recursive calls in HTMLRenderer.render_token() can exceed Python's recursion limit, raising a Recursi...

CVE-2026-21755

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755 HCL Hive is affected by a missing rate limit

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755 HCL Hive is affected by a missing rate limit

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755

HCL Hive is affected by a missing rate limit that could allow an attacker to achieve unauthorized access via brute-force or credential stuffing attacks, or cause a denion of service . The CVSS 3.1 base score is 5.3 (MEDIUM) with a network attack vector, low complexity, and no privileges required....

EUVD-2026-64893

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: eeprom: ee1004: limits the number of bytes that can be read via i2c to I2CSMBUSBLOCKMAX. The commit effa453168a7 “i2c: i801: Do not silently correct invalid transfer size” revealed that ee1004eepromread does not properly limit th...

Security update for Multi-Linux Manager Client Tools - Monitoring stack

This update fixes the following issues: grafana updated from version 11.6.14+security04 to version 12.4.5: Security fixes: CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints bsc1271331 - version 12.4.4 CVE-2025-12141: Fixed information leakage...

PT-2026-80880

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

PT-2026-81027

Name of the Vulnerable Software and Affected Versions Mistune versions 3.3.0 through 3.3.2 Description This issue allows a Denial of Service DoS through deeply nested tokens. When rendering HTML, consecutive asterisk characters can create deeply nested emphasis tokens. The recursive rendering...

CVE-2026-21755: Improper Restriction of Excessive Authentication Attempts

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

Oracle Linux 9 : qemu-kvm (ELSA-2026-500220)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500220 advisory. - tests/9p: add 3 xattr FID limit test cases local fs driver Christian Schoenebeck Orabug: 39636027 CVE-2026-8348 - tests/9p: add 3 xattr FID limit...

EUVD-2026-64661

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

CVE-2026-74696

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO maxqlen accounting across reuseport migration A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SOREUSEPORT...

CVE-2026-74685

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282writecurr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282writecurr / need to pass it in millivolt / u32 in =...

CVE-2026-74713 vhost_iotlb: bound map allocation in add_range

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...