PT-2026-79919

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CVE-2026-76400: Uncontrolled Resource Consumption

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API and influence responses from a Hypertext Transfer Protocol HTTP Event Collector endpoint in Splunk Enterprise could cause the connector to retry faile...

CVE-2026-69222: Uncontrolled Resource Consumption

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.joinsep. The concat filter can cheaply doub...

CVE-2026-54738: Improper Control of Interaction Frequency

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

EUVD-2026-61131

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/sharedfunc.py logs that an archive member exceeding ZIPMAXUNCOMPRESSEDFILESIZE is being skipped but does not continue to the next member, so an authenticated user can...

CVE-2026-50139

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

CVE-2026-50139 goshs: Share-link ?token=… redemption races past download limit

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

CVE-2026-50139

goshs (a SimpleHTTPServer written in Go, package goshs.de/goshs/v2) is affected by a race condition in ShareHandler prior to version 2.1.0. The handler reads a share token's DownloadLimit under a read lock, releases the lock, serves the file, and only then re-acquires a write lock to increment th...

EUVD-2026-60950

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

CVE-2026-50139

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

CVE-2026-50139 goshs: Share-link ?token=… redemption races past download limit

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

MiracleLinux 8 : bind9.16-9.16.23-0.22.el8_10.12 (AXSA:2026-1555:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1555:03 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

PT-2026-77278

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

EUVD-2026-60364

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-57485

Stirling-PDF versions prior to 2.9.0 contain an API key disclosure vulnerability in the /api/v1/pipeline/handleData endpoint (PipelineProcessor.java). The endpoint injects the STIRLING-PDF-BACKEND-API-USER key into pipeline subrequests, which an authenticated ROLE_USER can retrieve via /api/v1/us...

CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-57485

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

GHSA-V828-M3PF-VQ9Q New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

Summary Unauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive memory use and log...