PT-2026-99429

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Resource Consumption in Elasticsearch can lead to a denial of service through excessive allocation. This occurs when the system fails to limit the amount of resources...

CVE-2026-17545

A flaw was found in PHP. When running on Windows environments, PHP's filesystem and stream handlers fail to reject reserved system device names in file paths. An attacker who can control file or stream paths can supply these reserved names to open system devices instead of standard files. This ca...

GHSA-PG57-6JWG-Q645 Containerd has image-pull DoS via crafted OCI index graph amplification

Impact A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the PullImage operation, the recursive traversal and processing of child...

Containerd has image-pull DoS via crafted OCI index graph amplification

Impact A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the PullImage operation, the recursive traversal and processing of child...

CVE-2026-92560

A flaw was found in Apache Qpid Broker-J within the Advanced Message Queuing Protocol AMQP 0-10 decoder component. An unauthenticated remote attacker could exploit improper type size and count handling by sending specially crafted network messages. This can trigger excessive memory allocation,...

Allocation of Resources Without Limits or Throttling

Overview org.apache.qpid:qpid-broker-plugins-amqp-0-10-protocol is a maven plugin for AMQP 0-10 protocol broker. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via improper handling of type size and count in the AMQP 0-10 decoder. An...

Storm-3168: Agentic-driven cloud attacks using compromised service principals

In this article 1. Attack overview 2. Technical analysis 3. Mitigation and protection guidance 4. References 5. Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first...

Storm-3168: Agentic-driven cloud attacks using compromised service principals

In this article 1. Attack overview 2. Technical analysis 3. Mitigation and protection guidance 4. References 5. Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first...

Chromium CVE-2026-95324: Uninitialized resource in GPU

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-95366: Use of released resource in Core

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-95359: Uninitialized resource in GPU

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-95293: Uninitialized resource in GPU

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

BIT-GITLAB-2026-3855 Improper Control of Resource Identifiers ('Resource Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cau...

Various panics, soundness and resource exhaustion issues

Version 0.12.3 fixes a large number of panics, soundness issues, and CPU and memory exhaustion issues in all parts of the crate. The following is a summary of the issues per affected components. For details, please see the release notes. Base Limited the number of compression pointers that are...

CVE-2026-97607

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

UBUNTU-CVE-2026-98068

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rdsconnshutdown consume a concurrent drop rdsconnshutdown finishes by moving the path from RDSCONNDISCONNECTING to RDSCONNDOWN, and also accepts RDSCONNERROR as the starting state of that final transition, so...

UBUNTU-CVE-2026-98066

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

CVE-2026-98093 ASoC: fsl_micfil: balance mclk enable/disable

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslmicfil: balance mclk enable/disable hwparams enables mclk unconditionally and hwfree disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hwfree can run without hwparams, and hwparams can be call...

EUVD-2026-86923

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslmicfil: balance mclk enable/disable hwparams enables mclk unconditionally and hwfree disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hwfree can run without hwparams, and hwparams can be call...

CVE-2026-98068

The Linux kernel contains a race condition in the RDS (Reliable Datagram Sockets) protocol. Specifically, the rds_conn_shutdown() function could prematurely consume an RDS_CONN_ERROR state caused by a concurrent drop. This occurs when rds_tcp_accept_one() attaches a new socket; if a concurrent dr...