PT-2026-60964

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.1.13 Apache Traffic Server versions 10.0.0 through 10.1.2 Description An uncontrolled resource consumption issue exists in Apache Traffic Server. This flaw allows for a denial of service via stall...

PT-2026-60763

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The application implements an HTML5 cross-origin resource sharing CORS policy that allows access from any domain using a wildcard . CORS is a mechanism that allows restricted...

CVE-2026-54465: Allocation of Resources Without Limits or Throttling

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server using WebSocket::Driver.server or to complement a WebSocket client, a peer can make a single connection consume an unbounded...

The vulnerability of Rockwell Automation’s communication adapter software models 1718-AENTR and 1719-AENTR lies in their susceptibility to unlimited resource distribution, which allows a hacker to trigger a service failure.

The vulnerability of Rockwell Automation’s communication adapter software models 1718-AENTR and 1719-AENTR lies in their susceptibility to unlimited resource distribution. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the GPAC multimedia platform, related to improper cleaning or release of resources, allows a violator to trigger a service failure.

The vulnerability of the multimedia platform GPAC is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a hacker to cause service failures...

The vulnerability of the AppX Deployment Extensions for Windows operating systems allows attackers to increase their privileges.

The vulnerability of the AppX Deployment Extensions for Windows operating systems is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Cisco RoomOS operating system, related to insufficient resource control during its existence, allows a perpetrator to trigger a service failure.

The vulnerability of the Cisco RoomOS operating system is related to insufficient control over resources during its existence. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the Windows File Explorer driver on Windows operating systems, allowing attackers to disclose protected information

The vulnerability of the Windows File Explorer driver in Windows operating systems is related to the use of an uninitialized resource. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...

The vulnerability of Rockwell Automation’s 1734 POINT I/O microprogramming system, related to unlimited resource distribution, allows a hacker to trigger a service failure.

The vulnerability of Rockwell Automation’s 1734 POINT I/O software lies in its unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of software for modeling and simulating the operation of Siemens S7 controllers lies in the unlimited distribution of resources, which allows a hacker to trigger a service failure.

The vulnerability of software for modeling and simulating the operation of Siemens S7 controllers is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause malfunctions in service operations...

CVE-2026-54490: Allocation of Resources Without Limits or Throttling

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked...

CVE-2026-54340: Uncontrolled Resource Consumption

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...

Vulnerability of the Graphics component: Canvas2D in Mozilla Firefox, Firefox ESR, and the email client Thunderbird, which allows attackers to disclose protected information

The vulnerability of the Canvas2D component in Mozilla Firefox, Firefox ESR, and the Thunderbird email client is related to the use of an uninitialized resource. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information remotely...

The vulnerability of the Windows Telephony Service in Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Windows Telephony Service in Windows operating systems is related to competitive access to resources a state of competition. Exploiting this vulnerability can allow a perpetrator to enhance their privileges...

EUVD-2026-45017

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace...

Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

Impact Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching Gateway API ReferenceGrant in the target namespace. This breaks the Gateway API cross-namespace consent model: the namespace that owns the...

CVE-2026-44968

Summary: CVE-2026-44968 affects dbt-mcp (Model Context Protocol server). Prior to v1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended user-supplied MCP parameters to the dbt subprocess argv without validation. This enables argument-list injection via two vectors: (1) node_selecti...

CVE-2026-44968

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...