Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-106)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with read-only privileges to the alerting...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-98)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user wit...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-108)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user who is authorized to manage maintenance window...

Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-94)

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources Description: Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.1

cert-manager Operator for Red Hat OpenShift 1.19.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

RHSA-2026:47129 Red Hat Security Advisory: resource-agents security update

Bulletin has no description...

RHSA-2026:47126 Red Hat Security Advisory: resource-agents security update

Bulletin has no description...

CVE-2026-14298

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk...

python-idna: idna: Denial of Service via specially crafted long inputs

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...

CVE-2026-14298 Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk...

CVE-2026-14298

CVE-2026-14298 affects Mattermost releases: 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22. An authenticated user can trigger denial of service by causing resource exhaustion while processing certain user-supplied input. The CVE has a base score of 6.5 (MEDIUM) under CV...

CVE-2026-14298 Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk...

python-idna: idna: Denial of Service via specially crafted long inputs

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...

EUVD-2026-57686

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

PT-2026-71693

Name of the Vulnerable Software and Affected Versions HTML::FormHandler versions prior to 0.40069 Description An issue exists where apply actions and add error use error message text constructed from request data as a Locale::Maketext bracket notation template. Because the default handle's lexico...

PT-2026-71695

Name of the Vulnerable Software and Affected Versions Form::Processor::Field::HtmlArea versions 0.06 through 1.162360 Description An issue exists where the validate function processes submitted markup using HTML::Tidy and passes the resulting messages to the add error function. These messages are...

PT-2026-71765

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with read-only privileges to the alerting feature can cause a denial of service by submitting a specially crafted, malformed payload. This leads to excessive resource...

PT-2026-71787

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Kibana Fleet allows a user-supplied identifier for a Fleet Server host configuration to be accepted without rejecting relative traversal sequences. This identifier is stored and subsequently...

The vulnerability of the Linux operating system’s kernel Bluetooth module, allowing a hacker to trigger a service failure

The vulnerability of the Linux operating system’s kernel Bluetooth module is related to premature resource release. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the Linux operating system’s crypto kernel component, which allows a hacker to trigger a service failure

The vulnerability of the Linux operating system’s crypto kernel component is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a perpetrator to cause a service failure...