Kibana ML DoS

The vulnerability of the Machine Learning function of the Kibana data visualization service is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Kibana Canvas DoS

The vulnerability of the built-in Canvas tool in the Kibana data visualization service is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

Fedora 43 : perl-HTML-FormHandler (2026-167a356523)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-167a356523 advisory. HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method CVE-2026-85630...

Fedora 44 : perl-HTML-FormHandler (2026-21850d7df0)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-21850d7df0 advisory. HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method CVE-2026-85630...

Linux Distros Unpatched Vulnerability : CVE-2026-97504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - watchdog: lenovose10wdt: Fix use-after-free and resource leak risk Review by sashiko.dev highlighted potential use after free and resource leak instances. Set...

CVE-2026-87721: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption CWE-400 / CWE-407 in the ANTLR 3 search query parser QueryParser / Query.g in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker or an authenticated user if anonymous read...

PT-2026-97892

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak occurs in the fsl-imx8mq-usb PHY driver. If the probe process fails after the imx95 usb phy get tca function succeeds, the typec switch is not properly released because t...

Updated libwebsockets packages fix a security vulnerability

warmcat libwebsockets SSH Protocol sshd.c lwssshparseplaintext resource consumption. CVE-2026-10650...

MGASA-2026-0442 Updated libwebsockets packages fix a security vulnerability

warmcat libwebsockets SSH Protocol sshd.c lwssshparseplaintext resource consumption. CVE-2026-10650...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enables cross-tenant resource name enumeration

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

CVE-2026-66080

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enables cross-tenant resource name enumeration

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2026-66067

A flaw was found in RabbitMQ. The stream protocol handler does not correctly enforce per-user and per-virtual host vhost connection limits. An authenticated user can exploit this by connecting through port 5552, bypassing the intended connection restrictions. This could lead to resource exhaustio...

CVE-2026-54280

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. A remote attacker could exploit this vulnerability by disconnecting during a payload write, leading to improper closure of resources. This can cause temporary resource starvation, resulting in a Denial of Service DoS...

CVE-2026-71458 Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...