org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, causing a denial of service DoS for legitimate users...

apache-qpid-proton-dotnet: Apache Qpid Proton-Dotnet: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid Proton-Dotnet. A remote, unauthenticated attacker could exploit this vulnerability by leveraging unbounded symbol value caching, which can lead to resource exhaustion. This can cause a denial of service DoS, making the affected system unavailable to legitimate user...

qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service DoS. A denial ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the normalization. An attacker can exhaust system resources by submitting a specially crafted WS-Policy document containing repeated policy references that trigger exponential...

netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification

A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to...

Finished streaming calls keep reading a stalled request body indefinitely

Affected versions of connectrpc start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.apache.mina:mina-core is a network application framework which helps users develop high performance and high scalability network applications easily. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the...

CVE-2026-94149

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

CVE-2026-94149 Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

CVE-2026-94149 Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

CVE-2026-94149

Omega Solution HRM OS (versions up to 20260717) is affected by an improper control of resource identifiers flaw in the Role Permission Retrieval Endpoint at /role-permission/permission. Manipulating the roleId argument allows a remote, authenticated attacker (low privileges) to access permission ...

EUVD-2026-83859

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2026-94217 Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision

A flaw was found in the User-Managed Access UMA implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one...

CVE-2026-94217 Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision

A flaw was found in the User-Managed Access UMA implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one...

CVE-2026-94217

CVE-2026-94217 is a flaw in the User-Managed Access (UMA) implementation of Keycloak , specifically in the authorization token endpoint when processing permission tickets. When two different users own resources with the same name, the system incorrectly merges permissions from both resources when...

chromium-browser: skia: chromium-browser: Uninitialized resource in Skia

An uninitialized resource flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497205529...

chromium-browser: angle: ANGLE in Google Chrome: Cross-origin data disclosure via uninitialized resource

A flaw was found in ANGLE in Google Chrome. An uninitialized resource vulnerability exists that allows a remote attacker to potentially obtain cross-origin data by enticing a user to visit a crafted HTML page...

chromium-browser: angle: ANGLE: Information disclosure via uninitialized resource

A flaw was found in ANGLE, a component used in Google Chrome. A remote attacker could exploit an uninitialized resource vulnerability by tricking a user into visiting a specially crafted HTML page. This could allow the attacker to obtain sensitive cross-origin data, leading to information...