Filecoin Pin resource management error vulnerability

Filecoin Pin versions 1.1.0 and earlier contain a resource management error vulnerability. This vulnerability stems from the lack of rate limiting and per-user quotas on POST /pins in the file src/Filecoin Pinning-server.ts. Additionally, backend processing in src/Filecoin Pin-store.ts fails to...

CVE-2026-90870

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

EUVD-2026-113027

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

CVE-2026-90870 Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

CVE-2026-90870 Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

CVE-2026-90870

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows are vulnerable to server resource exhaustion. The root cause is a missing release of backend receiver sessions within the Ad Hoc Transfer component. Successful exploitation could lead to service degradation . No sp...

Progress Software WS_FTP Server resource management error vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.7 and 2025.0.4 contain a resource management error vulnerability. This vulnerability stems from the backend receiving sessions without proper release in the Ad Hoc Transfer component, potentially leading to server resource exhaustion and...

CVE-2026-90870: Progress Software WS_FTP Server: A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server…

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

PT-2026-132338

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

Linux Distros Unpatched Vulnerability : CVE-2026-109278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a...

Astra Linux – vulnerability in unbound

Unbound versions up to and including 1.25.0 are vulnerable to a service degradation attack related to parsing long lists of incoming EDNS options. An attacker sending queries containing an excessively large number of EDNS options can keep Unbound threads occupied while they parse and create...

CVE-2026-41510 OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGSPOST without enforcing the cap. The fl...

CVE-2026-41510

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains a flaw where request arguments are silently dropped once the SecArgumentsLimit (default 1000) is reached. Because the engine fails to set an error flag or notify rules, an unauthenticated attacker can bypass security rules targ...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

CVE-2026-109278

The ImageMagick software versions prior to 6.9.13-57 and 7.x before 7.1.2-32 are vulnerable to a memory leak within the wavelet-denoise operation . The root cause is a failure to release allocated memory when a required resource cannot be acquired. An attacker can repeatedly trigger this operatio...

CVE-2026-109270: Missing Release of Memory after Effective Lifetime

ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to gradually exhaust memory and degrade...

CentOS Linux 7 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python Multiple Vulnerabilities (CENTOS7:CLSA-2026:1779978016)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1779978016 advisory. - NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists o...

OESA-2026-4150 unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most...

CVE-2026-52745: Improper Neutralization of Special Elements used in an SQL Command

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULESETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression...

CVE-2026-85501 Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is...