CVE-2026-57227: Uncontrolled Resource Consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted...

ISC BIND 9.18.0 < 9.20.29 / 9.18.11-S1 < 9.20.29-S1 / 9.20.0 < 9.20.29 / 9.20.9-S1 < 9.20.29-S1 / 9.21.0 < 9.21.26 Multiple Vulnerabilities

The version of ISC BIND running on the remote host is 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, or 9.21.0 through 9.21.25. Supported Preview Edition releases 9.18.11-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1 are also affected. It is, therefore, affected by multiple...

CVE-2026-63448: Uncontrolled Resource Consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, becaus...

CVE-2026-63452: Uncontrolled Resource Consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With...

CVE-2026-57224: Uncontrolled Resource Consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::fordirection, so a...

PT-2026-95390

Name of the Vulnerable Software and Affected Versions wildfly-elytron-asn1 affected versions not specified Description A resource exhaustion flaw exists in the DERDecoder class. A remote attacker can trigger a Denial of Service DoS by sending a specially crafted DER Distinguished Encoding Rules...

Linux Distros Unpatched Vulnerability : CVE-2026-90415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/cxgb4: free STAG index when TPT entry write fails writetptentry allocates a new STAG index with c4iwgetresource and bumps stats.stag.cur before programming...

Linux Distros Unpatched Vulnerability : CVE-2026-92488

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/erdma: complete object teardown when the destroy command fails erdmadestroyqp, erdmadestroycq, erdmaderegmr, and erdmadestroyah returned early when...

Linux Distros Unpatched Vulnerability : CVE-2026-92524

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - irqchip/gic-v3-its: Prevent leak in itsvpeirqdomainalloc When itsirqgicdomainalloc fails, the following itsvpeirqdomainfree fails to invoke itsvepteardown for t...

Linux Distros Unpatched Vulnerability : CVE-2026-93083

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmware: armscmi: Unwind TX receiver mailbox setup failure mailboxchansetup can request an additional unidirectional TX receiver channel after successfully...

EulerOS Virtualization 2.12.0 : bind (EulerOS-SA-2026-3630)

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption...

CVE-2026-93309 O-RAN-SC SMO OAM VES Collector allocation of resources

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-93309 O-RAN-SC SMO OAM VES Collector allocation of resources

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-93308

CVE-2026-93308 affects the VES Collector component of O-RAN-SC SMO OAM (2025-06-10). The vulnerability allows a remote, low-privilege attacker to trigger an allocation of resources issue, resulting in a low availability impact (CVSS 3.1 base score: 4.3 – MEDIUM ). The specific functionality affec...

CVE-2026-93308 O-RAN-SC SMO OAM VES Collector allocation of resources

A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be...

CVE-2026-54671

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...

CVE-2026-54671

WeGIA (a web manager for charitable institutions) prior to 3.8.5 contains an authorization bypass. The root cause is an empty-resource authorization pattern : InternoControle is mapped to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php trea...

CVE-2026-54671 WeGIA: Authorization Bypass via Empty Resource Array in InternoControle

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...

Security Bulletin: Spring Framework (spring-expression) — Denial of Service via SpEL Power Operator

Summary spring-expression-6.2.19.jar detected by Mend scanner in db2-service-java/pom.xml. The affected version 6.2.19 is vulnerable to CVE-2026-47886 where applications evaluating user-supplied Spring Expression Language SpEL expressions using the power operator ^ with a BigDecimal or BigInteger...

Security Bulletin: Spring Framework (spring-web) — Open Redirect, Resource Exhaustion, Missing SameSite Cookie Attribute, and XML Memory Limit Bypass

Summary IBM Db2 Developer Extension is affected version 6.2.19 is vulnerable to 4 CVEs: CVE-2026-47883 CVSS 6.1 , CVE-2026-47885 CVSS 7.5 , CVE-2026-47889 CVSS 7.5 , CVE-2026-47891 CVSS 9.8 Vulnerability Details CVEID:CVE-2026-47883 DESCRIPTION: UrlHandlerFilter can be vulnerable to an open...