PT-2026-82618

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description A quadratic CPU exhaustion issue exists in the XMLCorpusView. read xml fragment function. This occurs because the system rescans accumulated XML fragments for every 1 KiB block read. An attacker can...

CVE-2026-81687: Uncontrolled Resource Consumption

opensslencrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs...

TencentOS Server 3: perl-Date-Manip (TSSA-2026:0907)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0907 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-81723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment that rescans accumulated XML fragments on every 1...

TencentOS Server 3: nodejs:24 (TSSA-2026:0919)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0919 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

SUSE SLES15 Security Update : python-sqlparse (SUSE-SU-2026:3762-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3762-1 advisory. - CVE-2026-54284: TokenList.init materializes Osubtree value per group, causing CPU DoS before depth/token caps trigger bsc1275459. -...

CVE-2026-75005: Inefficient Algorithmic Complexity

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue...

CVE-2026-81723: Uncontrolled Resource Consumption

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected...

CVE-2026-81699: Allocation of Resources Without Limits or Throttling

opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust syst...

PT-2026-82588

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to enforce a time ceiling on key derivation function KDF iteration counts specified in file metadata. A KDF is a cryptographic algorithm that derives one or more secret key...

CVE-2026-47881: Uncontrolled Resource Consumption

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume...

PT-2026-82449

Name of the Vulnerable Software and Affected Versions Apache APISIX version 3.17.0 Description An inefficient algorithmic complexity issue exists where a single small request can cause a gateway worker to reach 100% CPU usage for an extended period when using graphql-limit-count routes...

MiracleLinux 8 : kernel-4.18.0-553.153.1.el8_10 (AXSA:2026-1646:66)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1646:66 advisory. kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation CVE-2025-54518 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-81722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant...

Linux Distros Unpatched Vulnerability : CVE-2026-81725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption ...

CVE-2026-62326 Weblate Has Uncontrolled Resource Consumption via

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...

Duplicate Advisory: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rrv8-h7p8-rx55. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and...

K000163111: jq vulnerability CVE-2026-40164

Security Advisory Description jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed 0x432A9843 for all JSON object hash table operations, which allowed an attacker to precompute key collisions...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

FFmpeg: Denial of Service via crafted RTP/ASF stream

A flaw was found in FFmpeg. A remote attacker can exploit an infinite loop vulnerability in the RTP/ASF demuxer by sending a specially crafted stream. This vulnerability occurs because the rtpasffixheader function does not properly validate the size of data chunks, preventing the processing loop...