CVE-2026-69228 missing authentication vulnerability in Esri Portal for ArcGIS

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource not user content that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3...

EUVD-2026-64156

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource not user content that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3...

CVE-2026-77354 kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

CVE-2026-77354 kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

CVE-2026-77354

kin-openapi (Go library for OpenAPI file handling) versions 0.124.0 through 0.142.0 are affected by an uncontrolled resource consumption vulnerability in openapi3filter.sliceMapToSlice (req_resp_decoder.go). The function converts attacker-controlled sparse indexes from a deepObject query paramete...

CVE-2026-76876

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

EUVD-2026-64134

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose...

CVE-2026-63421 Keystone: `graphql.maxTake` bypass with negative `take`

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose...

CVE-2026-63421 Keystone: `graphql.maxTake` bypass with negative `take`

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose...

CVE-2026-63421

Keystone (Node.js CMS) prior to 6.5.3 contains a graphql.maxTake bypass in the findMany resolver (packages/core/src/lib/core/queries/resolvers.ts). The resolver compares the signed take argument directly against the configured maxTake bound, so a remote unauthenticated GraphQL client can supply a...

EUVD-2026-64068

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-70462

A flaw was found in rsync. A remote attacker can exploit a signed integer overflow vulnerability in the I/O timeout implementation by sending specially crafted messages. These messages can disable connection timeouts, causing idle or stalled connections to persist indefinitely. This leads to...

python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation

A flaw was found in Python's pkgutil.getdata function, which is used to retrieve data from packages. This function did not properly validate the resource argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories store...

CVE-2026-59654

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

CVE-2026-59654

Apache CloudStack's scoped global configuration functionality suffers from a resource leak (database connections not released after their effective lifetime), affecting modules such as Quota and Host-HA on the management server. Over time, the accumulated leak can lead to an eventual denial of se...

EUVD-2026-63941

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

CVE-2026-59654 Apache CloudStack: DoS caused by database connections leak

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

java-25-openjdk security update

An update is available for java-25-openjdk. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime...

RLSA-2026:55798 Moderate: java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fixes: JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Improve font loading CVE-2026-70906 JDK: Enhance TLS server...

CVE-2026-77755

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures...