SUSE CVE-2026-11573

Uncontrolled recursion CWE-674 in the QDomDocument/QDomNode serialization path of the Qt XML module QtXml, qtbase. QDomElementPrivate::save and QDomNodePrivate::save recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error...

SUSE CVE-2026-19201

An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service DoS. The WinEvents.readELAMAggregation function recurses for every nested elamAggregation sub-event without...

ROS-20260911-73-0006

The vulnerability of the xmtdiscardsubtree function in the MP4Box utility of the GPAC multimedia platform arises from stack overflow during uncontrolled recursion when processing an incorrect XMT scene. This allows a malicious actor to cause service failure...

CVE-2026-71641: Uncontrolled Resource Consumption

An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via thenteraction between trajserver, poscmd2odom, and the EGOReplanFSM emergency recovery logic...

Linux Distros Unpatched Vulnerability : CVE-2026-57227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQT...

CVE-2026-68497: Uncontrolled Resource Consumption

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

CVE-2026-50018: Uncontrolled Resource Consumption

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns...

GPAC multimedia platform Heap Buffer Overflow DoS

The vulnerability of the gfhevcreadspsbsinternal function in the mediatools/avparsers.c file of the GPAC multimedia platform is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.

Summary IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries. Vulnerability Details CVEID:CVE-2026-55831 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final,...

Security Bulletin: IBM MQ Appliance is affected by vulnerabilities in IBM WebSphere Application Server Liberty

Summary IBM MQ Appliance has addressed multiple vulnerabilities in IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

SummaryMistune v3.3.2 is vulnerable to a Denial of Service DoS attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with...

PYSEC-2026-3868 NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

PYSEC-2026-3854 Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML.init always reaches TreeBuilder.finish, which unconditionally calls populateselectedcontent. That function recursively traverses the DOM via findelements / findelement without a depth bound,...

Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Summaryjusthtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML.init always reaches TreeBuilder.finish, which unconditionally calls populateselectedcontent. That function recursively traverses the DOM via findelements / findelement without a depth bound,...

SUSE CVE-2026-87530

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

CVE-2026-88286: Uncontrolled Resource Consumption

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections...

CVE-2026-71647: Uncontrolled Resource Consumption

An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkCollisionCallback, execFSMCallback, planFromGlobalTraj in egoreplanfsm.cpp...