EUVD-2026-92153

A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attac...

ROS-20261005-73-0016

The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-105173: Improper Neutralization of Input During Web Page Generation

A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attac...

CVE-2026-104893: Allocation of Resources Without Limits or Throttling

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-105760: Uncontrolled Resource Consumption

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level mediaiokwargs field to select the GLMGA video backend and supply large values for the fps and maxframes options without a strict work ceiling. GLMGA constructs and deduplicates a...

CVE-2026-105749: Uncontrolled Resource Consumption

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/htmlbackend.py, docling/backend/jatsbackend.py, and...

CVE-2026-105444: Improper Control of Resource Identifiers

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...

CVE-2026-105686: Allocation of Resources Without Limits or Throttling

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

PT-2026-106230

Name of the Vulnerable Software and Affected Versions dotnet eShop version .NET 8 Description An issue exists in the Ordering API component within the GetOrderAsync function located in the src/Ordering.API/Apis/OrdersApi.cs file. A remote attacker can manipulate the OrderNumber argument to cause...

ROS-20261005-73-0017

The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20261005-73-0044

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0126

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0048

The vulnerability in the kernel-lt is related to the failure to release resources after their useful period has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...

ROS-20261005-73-0128

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0109

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0049

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0145

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0129

The vulnerability in the kernel-lt is related to the failure to release resources after their useful period has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...

Oracle Linux 10 : bind (ELSA-2026-75577)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75577 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent memory leak on following HTTPS/SVCB RR CVE-2026-81563 -...

ROS-20261005-73-0045

The vulnerability in the kernel-lt is related to the failure to release resources after their useful period has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...