Security Bulletin: IBM Event Endpoint Management is effected by Multiple Vulnerabilities

Summary IBM Event Endpoint Management is affected by Multiple Vulnerabilities and was addressed in IBM Event Endpoint Management 11.8.2 Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept extern...

CLEANSTART-2026-UO04337 Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies...

Security vulnerability affects the wildfly package. Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion...

Uncontrolled Recursion

Overview braces is a Bash-like brace expansion, implemented in JavaScript. Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to...

Uncontrolled Recursion

Overview org.webjars.npm:braces is a Bash-like brace expansion, implemented in JavaScript. Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the...

Exploit for CVE-2026-18464

CVE-2026-18464 — WP Maps Pro This repository is intended as a...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the ordered-JSON marshal/unmarshal paths through the jsonutils/adapters/stdlib/json and jsonutils/adapters/easyjson/json ordered map handlers. An attacker can crash the process by sending a deeply nested JSON...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the ordered-JSON marshal/unmarshal paths through the jsonutils/adapters/stdlib/json and jsonutils/adapters/easyjson/json ordered map handlers. An attacker can crash the process by sending a deeply nested JSON...

EulerOS Virtualization 2.12.1 : python-pyasn1 (EulerOS-SA-2026-3613)

According to the versions of the python-pyasn1 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service DoS...

EulerOS Virtualization 2.11.1 : python-pyasn1 (EulerOS-SA-2026-3466)

According to the versions of the python-pyasn1 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory...

EulerOS Virtualization 2.12.0 : python-pyasn1 (EulerOS-SA-2026-3667)

According to the versions of the python-pyasn1 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service DoS...

CVE-2026-61551: Uncontrolled Recursion

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

CVE-2026-59156: Uncontrolled Recursion

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits stream containing consecutive 2880-byte header blocks without the mandatory end keyword makes...

Autodesk Shared Components < 1.12.0 / 2.x < 2.2.0 DoS (adsk-sa-2026-0015)

The version of Autodesk Shared Components installed on the remote Windows host is prior to 1.12.0, or 2.x prior to 2.2.0. It is, therefore, affected by an uncontrolled recursion vulnerability. A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontroll...

Uncontrolled Recursion

Overview ioredis is a Redis client for Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the RESP protocol parser in lib/parser.js. An attacker can crash the Node.js client process by sending crafted RESP byte streams with repeated nested array headers. The...

CVE-2026-93450

CVE-2026-93450 affects go-openapi/swag (the jsonutils component) in versions before 0.27.1 . The root cause is unbounded recursion with no depth limit in ordered JSON marshal and unmarshal operations. A remote, unauthenticated attacker can submit a deeply nested JSON document to any service that ...

CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

CVE-2026-89418

A flaw was found in google-protobuf. An unauthenticated remote attacker can send a specially crafted message containing deeply nested protobuf group fields to a Node.js service using the affected library. This uncontrolled recursion can cause the service to crash, leading to a Denial of Service D...

CVE-2026-89418 Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested STARTGROUP wire bytes to any Node.js service that calls the generated deserializeBinary API, causing a RangeError: Maximum call stack size...

CVE-2026-54451: Uncontrolled Recursion

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...

CVE-2026-52852: Uncontrolled Recursion

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits...