PT-2026-89160

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

CVE-2026-86202: Insufficient Control of Network Message Volume (Network Amplification)

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste...

Linux Distros Unpatched Vulnerability : CVE-2026-87819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.nameemailregex that processes commit author and committer fields...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-sqlparse (UTSA-2026-106767)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106767 advisory. sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly...

Linux Distros Unpatched Vulnerability : CVE-2026-82075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded- cluster router process. A client that has network acce...

CVE-2026-80916: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on PREEMPTRT syzbot is reporting KCOV state corruption on PREEMPTRT kernels, for the temporary storage used for saving/restoring remote KCOV state is currently allocated as the per-CP...

CVE-2026-87819: Inefficient Regular Expression Complexity

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.nameemailregex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic...

CVE-2026-87013: Loop with Unreachable Exit Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...

TencentOS Server 3: python-pyasn1 (TSSA-2026:0990)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0990 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

openSUSE 16 Security Update : python-sqlparse (openSUSE-SU-2026:21777-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21777-1 advisory. This update for python-sqlparse fixes the following issue: - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption...

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Summary Nodemailer's address parser lib/addressparser/index.js parses a list of comma‑separated addresses in quadratic time — On² in the number of addresses. A single crafted address string e.g. a To, Cc, Bcc, From, or Reply‑To value, or any value passed to the exported addressparser therefore...

multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

GHSA-535W-7CP7-47Q4 multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.2...

EUVD-2026-69712

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources...

GHSA-2883-XCG3-V3HH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

xmldom: Quadratic-time attribute deduplication

Summary xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule no two attributes with the same qualified name /...

GHSA-F2FP-RGF2-35CP HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

Summary HTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

Summary HTTPX2's Server-Sent Events SSE parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this...