Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion

Summary SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-69152 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix and...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 5 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-2739 DESCRIPTION: This affects versions of the package bn.js before 5.2.3. Calling maskn0 on any BN instance...

libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel()

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...

Moderate: Red Hat Security Advisory: libcupsfilters security update

An update for libcupsfilters is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

CVE-2026-74276

A flaw was found in the Linux kernel's spi: xilinx driver. The driver incorrectly determines the size of its internal buffer, a First-In, First-Out FIFO queue. This miscalculation can lead to an overflow when the driver attempts to write more data than the FIFO can hold during a Serial Peripheral...

BIT-MONGODB-2026-13074 Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...

CVE-2026-72166

A flaw was found in the Linux kernel's 9p client remote procedure call RPC implementation. When the p9clientrpc function is called with a P9TFLUSH request and the transport has no peer, a fatal signal can cause an infinite loop. This prevents the affected process from terminating, leading to a...

PT-2026-78644

Name of the Vulnerable Software and Affected Versions Logto versions prior to 1.41.0 Description When the blockSubaddressing feature is enabled, the software uses an attacker-controlled domain from the email input to construct a regular expression. Due to a permissive emailRegEx that accepts...

RHEL 10 : libcupsfilters (RHSA-2026:56965)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:56965 advisory. Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional file...

PT-2026-78712

Name of the Vulnerable Software and Affected Versions LiquidJS versions 10.26.0 through 10.27.0 Description The strip html filter in src/filters/html.ts can enter an infinite loop when processing an input string that contains a character. This occurs because the search for the next opener advance...

ALSA-2026:56965 Moderate: libcupsfilters security update

Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications. Security Fixes: libcupsfilters: cups-filters:...

openSUSE 16 Security Update : python-PyPDF2 (openSUSE-SU-2026:21589-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21589-1 advisory. Changes in python-PyPDF2: - CVE-2026-59937: possible long runtimes for repeated malformed cross-reference entries bsc1271147 - CVE-2026-59936:...

SUSE CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

GO-2026-6115 WITHDRAWN: Multiple denial of service vulnerabilities in rsc.io/pdf and forks

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input: - Unchecked /Size, /Index,...

CVE-2026-72193

A flaw was found in the Linux kernel's ntfs3 driver. A remote attacker could exploit this by providing a specially crafted NTFS3 disk image, which, when mounted, triggers an in-kernel infinite loop. This can cause the system to hang, leading to a Denial of Service DoS where the system becomes...

CVE-2026-67214

A flaw was found in nanoid Nano ID, a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a...

OPENSUSE-SU-2026:21589-1 Security update for python-PyPDF2

This update for python-PyPDF2 fixes the following issues: Changes in python-PyPDF2: - CVE-2026-59937: possible long runtimes for repeated malformed cross-reference entries bsc1271147 - CVE-2026-59936: possible infinite loop for not terminated inline images bsc1271146...