CVE-2026-94407

IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is potentially vulnerable to denial of service due to uncontrolled regular expression complexity CWE-400 / ReDoS. An authenticated user with tool-registration privileges can embed catastrophically backtracking regex patterns in a tool's JSON Schem...

ad-password-protection

Lithnet Password Protection for Active Directory LPP enhances the options available to an organization wanting to ensure that all their Active Directory accounts have strong passwords. LPP is a module that you install on your Active Directory servers that uses a password filter to inspect passwor...

CVE-2026-6042-PoC

CVE-2026-6042: Algorithmic Complexity DoS in musl libc iconv Gap-skipping loops in musl's iconv GB18030 4-byte decoder allow a small crafted input to consume disproportionate CPU time. A 40 KB adversarial payload can pin a CPU core for over 40 minutes. Advisory :...

EUVD-2026-125221

NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.spantokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop0 calls. Attackers can submit long runs of double-quote characters to services...

EUVD-2026-125220

NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop t...

nat-tunnel

NAT Tunnel v0.01 If you have access to a server with public IP and unfiltered ports you can run NAT Tunnel NT server on the server, and NT client on your box behind NAT. the server requires 2 open ports: one for communication with the NT client --admin, the other for regular clients to connect to...

CVE-2026-127274

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high...

regexploit

Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...

EUVD-2026-124377

PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse. Attackers can supply a single-column quoted CSV with no delimiters, triggering...

CVE-2024-42850

CVE-2024-42850 An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. Writeup When changing your password, upon submission of the new password, the password is first sent in a POST request to an endpoint which checks t...

runc security update

An update is available for runc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The runC tool is a lightweight, portable implementation of the Open Container...

CVE-2026-127056: mholt PapaParse: PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated…

PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse. Attackers can supply a single-column quoted CSV with no delimiters, triggering...

openSUSE 16 Security Update : python-graphql-core (openSUSE-SU-2026:22258-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22258-1 advisory. Changes in python-graphql-core: - CVE-2026-75507: Fix quadratic complexity in OverlappingFieldsCanBeMerged validation rule when comparing nested...

Alibaba Cloud Linux 3 : 0361: grafana-pcp (ALINUX3-SA-2026:0361)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0361 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-111943: On most platforms, Go use...

Rocky Linux 9 [CIQ] Security Update: runc / runc-debuginfo / runc-debugsource (crlsa-2026_98451)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202698451 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 Tenable has extracted the preceding description bloc...

CVE-2026-64861

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousand...

dotnet8.0: ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-64861 Probo: GraphQL Alias-Based Application Layer Denial of Service (DoS)

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousand...

CVE-2026-64861 Probo: GraphQL Alias-Based Application Layer Denial of Service (DoS)

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousand...

CVE-2026-64861

The Probo GRC platform is vulnerable to an application layer Denial of Service (DoS) via its GraphQL endpoint in versions prior to 0.222.0 . The root cause is a lack of enforced restrictions on alias count , query depth , and query complexity . An attacker can exploit this by sending a single req...