vm2 require.external Code Execution

The vulnerability of the require.external component in the vm2 package manager NPM is related to insufficient control over resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux kernel XFRM/IPsec DoS

The vulnerability of the functions copytouseraead, copytouserealg, and copytouserstateextra in the net/xfrm/xfrmuser.c sub-module of the XFRM/IPsec subsystem in Linux operating systems is related to insufficient control over resources with dynamic management. Exploitation of this vulnerability...

ROS-20260921-73-0130

The vulnerability in Golang is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

SUSE SLED15: java-21-openjdk / java-21-openjdk-demo / java-21-openjdk-devel / etc (SUSE-SU-2026:4006-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4006-1 advisory. Security issues fixed: - CVE-2026-60589: OpenJDK: Improve Resource Resolving bsc1275777. - CVE-2026-61308:...

ROS-20260921-73-0061

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

Cisco IOS XR Software Security Hardening Release: September 2026 (cisco-sa-hardening-iosxr-qg64NcM)

According to its self-reported version, Cisco IOS XR is affected by multiple vulnerabilities. - Multiple vulnerabilities in Cisco IOS XR Software due to improper resource control issues could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service conditio...

ROS-20260921-73-0132

The vulnerability in Golang is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260921-73-0128

The vulnerability in Golang is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

PT-2026-96279

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.7 Description An issue exists where the 'GET /shares/:id?resource id=' endpoint serves resources with an attacker-controlled mime value and omits the Content-Disposition header when the resource title is...

MGASA-2026-0422 Updated bind package fixes security vulnerabilities

Unauthenticated IXFR deltas are applied to the live zone before TSIG verification CVE-2026-19033. qpcache NOQNAME proof use-after-free crashes recursive resolver CVE-2026-19662. Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path CVE-2026-19666. Remote assertion failure via 16-bit...

javadelight delight-nashorn-sandbox 0.5.5 Resource Consumption

javadelight delight-nashorn-sandbox version 0.5.5 contains an uncontrolled resource consumption vulnerability because dynamic JavaScript code evaluation can bypass statically inserted loop interruption checks and consume CPU...

SUSE CVE-2026-89909

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Free init resources if kvminit fails kvmloongarchinit calls kvmloongarchenvinit to allocate the per-CPU kvmcontext vmcs and kvmloongarchops and to register the perf callbacks, and then calls kvminit. If kvminit...

SUSE CVE-2026-93116

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: fix resource leaks on probe failure During driver initialization in asuswmiadd, various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration...

SUSE CVE-2026-93130

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-base: Fix resource leak on module load failure We need to properly clean up the SMBIOS request and the privacy driver when the module load fails...

CLEANSTART-2026-DQ29252 It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service

CVE-2026-66277 affects multiple packages. It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. See references for individual vulnerability details...

CLEANSTART-2026-KJ02957 pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service

CVE-2026-66257 affects multiple packages. A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-LW37073 There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of serv...

Security vulnerability affects the wso2am package. There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack...

Linux Distros Unpatched Vulnerability : CVE-2026-77528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept...

CVE-2026-75885

A flaw in the OpenShift console allows unauthenticated remote attackers to exploit the /api/devfile/ and /api/devfile/samples/ endpoints. Two distinct impacts are possible: Server-Side Request Forgery (SSRF) , where the console pod makes requests to internal services and reflects partial response...

Allocation of Resources Without Limits or Throttling

Overview crossbar is a Crossbar.io multi-protocol WAMP/WebSocket, REST/HTTP, MQTT application router for microservices. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the onFrameData function in protocol.py, where the...