ROS-20261005-73-0065

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106134

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.5.14 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An asymmetric resource consumption amplification issue exists when a request parameter is bound to ...

Oracle Linux 10 : bind (ELSA-2026-75577)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75577 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent memory leak on following HTTPS/SVCB RR CVE-2026-81563 -...

Fedora 44 : chromium (2026-35b989661c)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-35b989661c advisory. Update to 154.0.8037.92 CVE-2026-102299: Type confusion in V8 CVE-2026-102300: Uninitialized resource in WebGPU CVE-2026-102301: Out of bounds write...

ROS-20261005-73-0126

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0016

The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20261005-73-0017

The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

Security Bulletin: Vulnerabilities reported in cxf-rt-frontend-jaxrs-4.2.2.jar are addressed in APIM 11.1

Summary Vulnerabilities reported in cxf-rt-frontend-jaxrs-4.2.2.jar are addressed in APIM 11.1 Vulnerability Details CVEID:CVE-2026-57819 DESCRIPTION: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. Howeve...

CVE-2026-57819

A flaw was found in Apache CXF. This vulnerability allows a remote attacker to initiate a Denial of Service DoS attack. The issue arises because the component does not enforce a default limit on the number of form parameters processed in a JAX-RS message, enabling an attacker to send requests wit...

CVE-2026-105127: Allocation of Resources Without Limits or Throttling

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

openSUSE 16: jline3 / jline3-builtins / jline3-console / jline3-console-ui / etc (openSUSE-SU-2026:22009-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22009-1 advisory. This update for jline3 fixes the following issue: Update to upstream version 3.30.17: Security Fixes + Native Stack Buffer Overflow in Public...

CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127

The LaraDashboard software (versions 1.4.2 before 1.4.8 ) is vulnerable to a resource exhaustion issue within its unauthenticated forgot-password and reset-password endpoints. The root cause is the application's use of advanced email validation, which triggers external DNS lookups and paid Abstra...

CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

Security Bulletin: Due to the use of HTTP/2 requests to a Jetty server, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-12611)

Summary HTTP/2 requests with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http2-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-12611 DESCRIPTION: A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never...

Security Bulletin: Due to the use of jackson-databind, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-68497)

Summary Jackson-databind is used by IBM Sterling Control Center as part of dependency in jackson-databind-2.17.1.jar Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PBEPBKDF2 implementation in prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java. An attacker can force excessive CPU work by supplying a...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PBEPBKDF2 implementation in...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PBEPBKDF2 implementation in prov/src/main/java/org/bouncycastle/jcajce/provider/symmetric/PBEPBKDF2.java. An attacker can force excessive CPU work by supplying a...