PT-2026-80333

Summary An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array a normal, documented pattern,...

PT-2026-79349

Name of the Vulnerable Software and Affected Versions io.micrometer:micrometer-tracing-bridge-brave affected versions not specified Description An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is susceptible to denial of service DoS. The issue occurs during...

ROS-20260821-73-0015

The vulnerability in the arch/powerpc/kernel/rtasflash.c module of the Linux operating system is related to unlimited resource allocation. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-63384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102060)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102060 advisory. In the Linux kernel, the following vulnerability has been resolved: pagepool: always add GFPNOWARN for ATOMIC allocations Driver authors often forget to add GFPNOWAR...

Linux Distros Unpatched Vulnerability : CVE-2026-68555

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP...

Kibana 8.12.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-102 / ESA-2026-108)

The version of Kibana installed on the remote host is 8.12.x prior to 8.19.19, 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-102 and ESA-2026-108 advisories. - Missing Authorization CWE-862 in Kibana can lead to...

Kibana 9.3.x < 9.3.8 / 9.4.x < 9.4.4 Denial of Service (ESA-2026-91)

The version of Kibana installed on the remote host is 9.3.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-91 advisory. - Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service vi...

CVE-2026-59323: Allocation of Resources Without Limits or Throttling

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service DoS due to unbounded object allocation when extracting incoming baggage headers. Micrometer Tracing 1.7.0 Micrometer Tracing 1.6.0 - 1.6.6 Micrometer Tracing 1.5.0 - 1.5.12...

CVE-2026-77354: Uncontrolled Resource Consumption

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

Security Games on Series-Parallel Attack Graphs with Adaptive Attackers

We study security games on attack graphs, where an adaptive attacker seeks to reach a target by sequentially attempting stochastic controls along the current attack frontier, while a defender allocates limited resources across controls to delay compromise. The attacker may choose among...

PT-2026-79295

Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading to OOB read and/or write due to improper validation of the said value. Such crafted log2 page size could lead to 4K pages being treated a...

ROS-20260821-73-0069

The vulnerability of the cgroup kernel component in the Linux operating system is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a perpetrator to cause a service failure...

Apache Struts 6.0.0 <=> 6.10.0 / 7.0.0 <=> 7.2.1 Denial of Service (S2-073)

The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is, therefore, affected by a denial of service vulnerability as referenced in the S2-073 advisory. - Struts provides an optional facility for collecting Content Security Policy violatio...

Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-92 / ESA-2026-98 / ESA-2026-100 / ESA-2026-104 / ESA-2026-105 / ESA-2026-106 / ESA-2026-110)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-92, ESA-2026-98, ESA-2026-100, ESA-2026-104, ESA-2026-105, ESA-2026-106 and ESA-2026-110 advisories. - Missing...

CVE-2026-74435

A flaw was found in the rxrpc subsystem of the Linux kernel. This vulnerability occurs when the rxrpcverifydata function fails to allocate a necessary buffer if the incoming data length is zero. An attacker could exploit this by sending specially crafted network packets, leading to a NULL pointer...

CVE-2026-17170

IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 fail to properly validate an allocation size, allowing an unauthenticated remote attacker to trigger a denial of service (CVSS 7.5 HIGH, availability impact). IBM's support page (https://www.ibm.com/support/pages/node/7283858) may contain patch details. No in...

CVE-2026-17170 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an allocation size...

CVE-2026-17170 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an allocation size...

DEBIAN-CVE-2026-70652

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...