PT-2026-94732

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The folio batch mechanism used for iomap zero range fails to release the batch during specific error scenarios. This occurs when calls to the -iomap begin or -iomap end functions fail,...

EUVD-2026-80803

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated bat...

CVE-2026-92625: Missing Authentication for Critical Function

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated bat...

CVE-2026-83489

Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications component: Onboarding Batch Processes. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP t...

EUVD-2026-79776

Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications component: Onboarding Batch Processes. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP t...

CVE-2026-83489

This vulnerability affects Oracle Banking Origination (Oracle Financial Services Applications), specifically the Onboarding Batch Processes component, in supported versions 14.5.0.0.0 through 14.9.0.0.0 . A low-privileged attacker with network access via HTTP can exploit this vulnerability, which...

EUVD-2026-78658

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

CVE-2026-91987 atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

This Week in Spring - September 15th, 2026

Hi, Spring fans! Welcome to another rip-roarin' installment of This Week in Spring! I'm writing this to you from sun-kissed San Francisco, CA, sipping some coffee and watching the bay from my breakfast nook. What a wonderful day! A wonderful day in which to learn about the latest and greatest in...

CVE-2026-83489: Improper Privilege Management

Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications component: Onboarding Batch Processes. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP t...

CVE-2026-91987: Allocation of Resources Without Limits or Throttling

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

PT-2026-92944

Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications component: Onboarding Batch Processes. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP t...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: BPF: Added schedule points in batch operations. SYZbot reported various soft lockups caused by BPF batch operations. INFO: Task kworker/1:1:27 was blocked for more than 140 seconds. INFO: Task hung during the rcubarrier...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Rejected duplicate devices during updates. It is possible for a chain/flowtable update to include duplicate devices within the same batch. Unfortunately, the netdev event path only removes the first device...

CVE-2026-89756

A flaw was found in the Linux kernel. When performing memory migration on KVM Kernel-based Virtual Machine hosts, the migratepagesbatch function fails to report RCU Read-Copy Update tasks quiescent states during large batch unmapping operations. This oversight causes the migrating task to become ...

CVE-2026-82578

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-82578 NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

EUVD-2026-76117

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-82578 NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...

CVE-2026-82578

NextGen Healthcare Mirth Connect is affected by an XXE injection vulnerability in its XML batch processing feature. When the XPath option is selected, raw batch input is processed through a default XPath/JAXP parser with no entity restrictions , allowing an unauthenticated, network-based attacker...