CVE-2026-8285: Improper Restriction of Excessive Authentication Attempts

Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 before 5.542.0...

CVE-2026-55831: Allocation of Resources Without Limits or Throttling

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in...

CVE-2026-56145: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive...

PT-2026-62096

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Resource Consumption in Elasticsearch can lead to a denial of service through excessive allocation. A user with search privileges can submit a specially crafted search...

PT-2026-61934

Name of the Vulnerable Software and Affected Versions FlexCity versions 5.536.0 through 5.541.0 Description Improper restriction of excessive authentication attempts allows Excessive Allocation, a condition where a system allocates more resources than necessary or available, potentially leading t...

FreeRDP RDP Client DoS

The vulnerability of the freerdpclientrdpfileapplytoSettings function in the RDP client FreeRDP is related to the reallocation of memory. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a specially crafted .rdp file...

Mellanox Ethernet driver Heap Buffer Overflow

The vulnerability of the mlx5irqalloc function in the drivers/net/ethernet/mellanox/mlx5/core/pciirq.c file of the Mellanox Ethernet network adapter driver for the Linux operating system is related to the distribution of resources without any restrictions or regulation. Exploiting this...

EulerOS Virtualization 2.12.0 : libarchive (EulerOS-SA-2026-2779)

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper...

Amazon Linux 2 : python-pillow, --advisory ALAS2-2026-3816 (ALAS-2026-3816)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3816 advisory. Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py loadbitmaps read glyph dimension...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2733)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation...

EUVD-2026-44406

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability...

EUVD-2026-44398

Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability...

EUVD-2026-44353

Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the getBodyLength and resolveBodyLength functions of lib/adapters/fetch.js, which lack a branch fo...

EUVD-2026-41901

Pillow GdImageFile.open: image dimensions accepted without decompressionbombcheck...

GHSA-45HQ-CXWH-F6VC Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Summary PIL/BdfFontFile.py bdfchar lines 84–88 reads the BBX width height field from a BDF font file and passes the dimensions directly to Image.new without calling Image.decompressionbombcheck. This completely bypasses Pillow's documented decompression bomb protection. Image.open enforces...

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Summary PIL/BdfFontFile.py bdfchar lines 84–88 reads the BBX width height field from a BDF font file and passes the dimensions directly to Image.new without calling Image.decompressionbombcheck. This completely bypasses Pillow's documented decompression bomb protection. Image.open enforces...

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Description PIL/PcfFontFile.py loadbitmaps line 227 reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes without calling Image.decompressionbombcheck. Dimensions originate from unsigned 16-bit values: xsize = right - left max: 65535 − 0 = 65535 ysize =...

MGASA-2026-0273 Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftpsymlink in sftp.c. CVE-2025-15661 libssh2 userauth.c userauthpassword integer overflow. CVE-2026-7598 Pre-Authentication DoS via SSHMSGEXTINFO Handler. CVE-2026-55199 Out-of-Bounds Write via Unchecked packetlength in...

ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service DoS by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users...