EUVD-2026-35891

Spring Data: Unbounded property-path cache keyed by externally-supplied path string...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to linkify-it and httpcore5 (CVE-2026-59887, CVE-2026-54428 & CVE-2026-54399)

Summary IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to linkify-it and httpcore5. Vulnerability Details CVEID:CVE-2026-59887 DESCRIPTION: linkify-it is a links recognition library with full Unicode support...

UBUNTU-CVE-2026-18358

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

Missing Release of Resource after Effective Lifetime

Overview org.apache.httpcomponents.client5:httpclient5 is a HttpClient component of the Apache HttpComponents project. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the ContentCompressionExec response decoding path in...

CVE-2026-18358

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

CVE-2026-18358

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

EUVD-2026-51528

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-16105 Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...

CVE-2026-16105

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...

CVE-2026-8804

A flaw was found in Puppet resourceapi. This vulnerability occurs because the resource-api does not properly preserve the sensitive flag on parameters. As a result, sensitive information, such as passwords, can be stored in cleartext within the agent's local transaction state cache. This could...

The vulnerability of the Unbound DNS server, related to improper blocking of resources, allows a hacker to trigger a service failure.

The vulnerability of the Unbound DNS server is related to improper blocking of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the brace-expansion library in the Node.js software platform, related to uncontrolled resource consumption, allows attackers to trigger a service failure.

The vulnerability of the brace-expansion library on the Node.js software platform is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of Java Cryptography Libraries Bouncy Castle for Java FIPS and Bouncy Castle for Java LTS lies in their uncontrolled resource consumption, which allows attackers to cause service failures.

The vulnerability of Java Cryptographic Libraries, specifically Bouncy Castle for Java FIPS and Bouncy Castle for Java LTS, is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow attackers to cause service failures...

IBM DataPower Gateway Denial-of-Service Vulnerability (CNVD-2026-31545)

IBM DataPower Gateway is an enterprise-level data integration and security gateway product that provides features such as API management, message routing, and protocol conversion. There is a denial-of-service vulnerability in IBM DataPower Gateway. This vulnerability stems from improper resource...

The vulnerability of Google Chrome’s Directory service allows a hacker to trigger a service failure.

The vulnerability of the Google Chrome browser’s directory service is related to insufficient control over the resource during its existence. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of Google Chrome’s Payments component, which allows a violator to trigger a service failure.

The vulnerability of Google Chrome’s Payments component is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the library for serializing JavaScript objects into a string format, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the library for serializing JavaScript objects into a string format is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the dwc2_hsotg_udc_stop() function in the drivers/usb/dwc2/gadget.c file of the Linux operating system’s device driver framework allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dwc2hsotgudcstop function in the drivers/usb/dwc2/gadget.c file of the Linux device driver framework relates to the unlocking of a locked resource. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability of the ulpi_register_interface() function in the drivers/usb/common/ulpi.c module of the Linux operating system’s USB device driver framework allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ulpiregisterinterface function in the drivers/usb/common/ulpi.c module of the Linux device driver framework is related to the multiple release of the same resource or descriptor. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...