CVE-2026-86198

PocketMine-MP versions before 5.44.2 are vulnerable to a denial-of-service condition in the resource pack handling subsystem. The root cause is a failure to properly validate multiple ResourcePackClientResponsePacket packets carrying the STATUS_COMPLETED status, which allows malicious clients to ...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption bsc1278097. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to ...

Denial Of Service (DoS)

Netty is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient quadratic CPU processing when aggregating large TLS ClientHello messages split across many small records, which allows an unauthenticated remote attacker to consume excessive CPU resources and degrade TLS handli...

The vulnerability of the _get_outline() function in the pypdf/_doc_common.py library of the Python library for working with PDF files, PyPDF, allows a attacker to cause a service failure.

The vulnerability of the getoutline function in the pypdf/doccommon.py library of the Python PDF handling library PyPDF is related to asymmetric resource consumption. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-87013: Loop with Unreachable Exit Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...

CVE-2026-87011: Asymmetric Resource Consumption (Amplification)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...

CVE-2026-71616: Uncontrolled Resource Consumption

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gfroutemediacompleteobject. Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab...

CVE-2026-22591: Uncontrolled Resource Consumption

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering DDSSQLFilter allows any participant in a DDS domain to remotely...

CVE-2025-71418: Uncontrolled Resource Consumption

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...

CVE-2023-54394: Allocation of Resources Without Limits or Throttling

PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data...

CVE-2026-53937: Uncontrolled Resource Consumption

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-sqlparse (UTSA-2026-106767)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106767 advisory. sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly...

The vulnerability of the uniwill_init() function in the drivers/platform/x86/uniwill/uniwill-acpi.c driver for X86 processors in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the uniwillinit function in the drivers/platform/x86/uniwill/uniwill-acp.c driver for X86 devices in the Linux operating system is related to improper energy consumption restrictions. Exploiting this vulnerability could allow an attacker to cause a service failure...

Kibana 8.x < 8.19.21 / 9.0.x < 9.4.6 / 9.5.x < 9.5.2 Incorrect Authorization (ESA-2026-169)

The version of Kibana installed on the remote host is 8.x prior to 8.19.21, or 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-169 advisory. - Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead...

CVE-2026-86204: Uncontrolled Resource Consumption

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources, rendering the...

CVE-2026-86198: Improper Enforcement of a Single, Unique Action

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86201: Uncontrolled Resource Consumption

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object...

Kibana 8.x < 8.19.17 / 9.0.x < 9.3.0 DoS (ESA-2026-31)

The version of Kibana installed on the remote host is 8.x prior to 8.19.17, or 9.0.x prior to 9.3.0. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-31 advisory. - Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service vi...