Oracle Linux 9 : bind (ELSA-2026-75767)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75767 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3...

PT-2026-107985

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-55 ImageMagick versions prior to 7.1.2-30 Description A security policy bypass exists in the MAT decoder. The issue occurs because the decoder fails to enforce configured temporary file size limits when...

EulerOS 2.0 SP15 : libwebsockets (EulerOS-SA-2026-3990)

According to the versions of the libwebsockets packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lwssshparseplaintext of the file...

CVE-2026-97031: Asymmetric Resource Consumption (Amplification)

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

ROS-20261008-73-0216

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261008-73-0218

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-16169: Uncontrolled Resource Consumption

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption...

EulerOS 2.0 SP15 : dhcp (EulerOS-SA-2026-3904)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

PT-2026-107976

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A resource leak occurs when the software processes a crafted magick script, allowing attackers to leave file pointers open. This leads to the leakage of file descriptors, which can exhaust...

EulerOS 2.0 SP15 : dhcp (EulerOS-SA-2026-3970)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

ROS-20261008-73-0236

The vulnerability of the mctu232readintcallback function in the drivers/usb/serial/mctu232.c file of the Linux device driver for USB devices relates to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to cause a service failure...

Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway

Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may...

CVE-2026-76282

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by...

EUVD-2026-94634

Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration CWE, with one Common Vulnerabilities and Exposures...

CVE-2026-76282 Improper Control of a Resource Through its Lifetime in Splunk Enterprise

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by...

CVE-2026-76282

Splunk Enterprise versions 10.4.3 , 10.2.7 , 10.0.10 , and 9.4.15 are affected by CVE-2026-76282 , which involves Improper Control of a Resource Through its Lifetime (CWE-664). Splunk addressed these internally identified vulnerabilities by grouping them by CWE and assigning specific identifiers ...

GHSA-PC36-QWJQ-X68C Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Summary When remote fetching is enabled enableremotefetch=True, together with fetchimages=True or HTML renderpage=True, docling's protection against requests to private and loopback addresses can be bypassed. - The URL check resolves the host name once, to a single IPv4 address. The HTTP request...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader process. An attacker can cause excessive CPU and garbage collection usage by providing specially...

Allocation of Resources Without Limits or Throttling

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader...

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Summary Langflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply ...