CVE-2026-13074

Affected software: MongoDB server. Vulnerable component: the awaitable hello command in exhaust mode. Root cause: handling of a specific parameter combination leads to a response loop that bypasses normal throttling. Impact: unauthenticated remote clients can cause excessive CPU consumption and d...

EUVD-2026-47787

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...

CVE-2026-13074

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...

CVE-2026-13074 Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...

CVE-2026-13074 Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...

CVE-2026-13074 Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...

Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...

prismor v1.30.3

Prismor Runtime security hooks for Claude Code, Codex, and other AI coding agents. Prismor can also be used in observe mode to see agent session activity and dangerous actions in a local self-serve dashboard Website • Onboard with Skill !Trae / Trae CNht...

CVE-2026-7328

CVE-2026-7328 concerns Caliptra Core Runtime Firmware (2.1.0) and reports missing authorization in subsystem mode for INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD commands. This allows a privileged local attacker to trigger a denial-of-service via mailbox commands that con...

CVE-2026-7328 Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-7328 Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-7328 Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

Missing authorization in Caliptra Core Runtime Firmware INVOKEDPEMLDSA87, CMAESGCMDECRYPTDMA, EXTERNALMAILBOXCMD commands in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond...

CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

Security update for ImageMagick

This update for ImageMagick fixes the following issues CVE-2026-56375: possible memory leak in ASHLAR coder when action fails bsc1271495. CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title bsc1271496. CVE-2026-61859: policy bypass in script operation due to missing chec...

OPENSUSE-SU-2026:21415-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues - CVE-2026-58374: Fixed a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be MLO association request processing allows an unauthenticated user to send a crafted management frame and cause an out-of-bounds write bsc1269892...

SUSE-SU-2026:22931-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues - CVE-2026-58374: Fixed a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be MLO association request processing allows an unauthenticated user to send a crafted management frame and cause an out-of-bounds write bsc1269892...

SUSE-SU-2026:22851-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues - CVE-2026-58374: Fixed a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be MLO association request processing allows an unauthenticated user to send a crafted management frame and cause an out-of-bounds write bsc1269892...

Cross-site Scripting (XSS)

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Cross-site Scripting XSS in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. An attacker can execute arbitrary scripts in the context of the...

SUSE-SU-2026:22894-1 Security update for libxml2

This update for libxml2 fixes the following issue - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790...

SUSE-SU-2026:22806-1 Security update for libxml2

This update for libxml2 fixes the following issue - CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790...