Allocation of Resources Without Limits or Throttling

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 backlog tracking when a stream is reset. An attacker can exhaust system resources by repeatedl...

Allocation of Resources Without Limits or Throttling

Overview org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 backlog tracking when a...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-69104

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

EUVD-2026-65521

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

CVE-2026-69104 Potential unauthorized repository migration in JFrog Artifactory

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

CVE-2026-69104: Missing Authorization

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

PT-2026-81332

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

CVE-2026-54449

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-9033: Missing Authentication for Critical Function

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful...

CVE-2026-76336

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76336

Splunk Enterprise versions below 10.4.2 (mainline) and 10.2.6 (LTS) are affected: the SPL2 module management REST API lacks sufficient authorization and validation on module deletion, letting any non-admin/non-power user delete all SPL2 modules instance-wide, wiping exported datasets/functions, c...

CVE-2026-53542: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-76336: Missing Authorization

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

ROS-20260817-73-0021

The vulnerability of the Microsoft .NET Framework software platform is related to the execution of operations outside the buffer in memory. Exploitation of this vulnerability can allow a remote attacker to cause service interruptions...

Linux DRM/V3D DoS

The vulnerability of DRM/V3D components in the Linux operating system is related to incorrect calculation of buffer sizes. Exploiting this vulnerability can allow a hacker to cause service interruptions...

Allocation of Resources Without Limits or Throttling

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the search. An attacker can exhaust system memory and cause the node...

baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling

A flaw was found in baseline-browser-mapping. This vulnerability allows an attacker to cause a denial of service by providing invalid or conflicting input parameters. The affected component improperly terminates the process instead of handling the input error gracefully, leading to immediate...

CVE-2026-11932

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack...

Openvswitch Kernel Module Buffer Overflow DoS

The vulnerability of the queuegsopackets and queueuserspacepacket functions in the openvswitch kernel module of Linux operating systems is related to a single-byte offset error. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...