PT-2026-68186

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.2 Description Improper Handling of Length Parameter Inconsistency allows unauthenticated attackers to cause a denial of service. This is achieved by sending a specially crafted Accept-Language header that...

Python cryptography Package DoS

The vulnerability of the buildchaininner function in the Python programming language’s cryptography library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

hermes-agent has an Uncontrolled Resource Consumption issue

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function handlewebhookrequest of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be...

PYSEC-2026-3576 hermes-agent has an Uncontrolled Resource Consumption issue

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function handlewebhookrequest of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be...

CVE-2026-16548: Unrestricted Upload of File with Dangerous Type

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

CVE-2026-67861: Uncontrolled Resource Consumption

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UAClientgetRemoteDataTypes component...

CVE-2026-70489: Uncontrolled Resource Consumption

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/openwebui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to...

CVE-2026-58045: Uncontrolled Resource Consumption

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

PT-2026-67837

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.7.0 through 0.10.0 Description An authenticated user whose features.image generation permission has been revoked can still trigger image generation by sending a feature flag in a chat-completion request. The server fails ...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses HdrHistogram-2.1.12.jar which is vulnerable to CVE-2026-14683, CVE-2026-14684, CVE-2026-14685, CVE-2026-14686. This bulletin contains information regarding the vulnerability and how to address it. Vulnerability Details CVEID:CVE-2026-14683...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification,...

PT-2026-76184

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the...

PT-2026-67340

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively...

PT-2026-76158

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

CVE-2026-67976: Uncontrolled Resource Consumption

The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service DoS via inputting unsafe parameters...

CVE-2026-68981: Improper Handling of Highly Compressed Data (Data Amplification)

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-69152: Uncontrolled Resource Consumption

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...