CLEANSTART-2026-HC65345 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...

CLEANSTART-2026-DW61297 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:4625-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4625-1 advisory. Update to go1.27.2 bsc1272545: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on...

PT-2026-111344

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

PT-2026-111345

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

PT-2026-111380

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC Drive Controller CPU 1504D TF affected versions not specified Description Devices do not properly restrict executable content within imported trace files. An attacker could social engineer an authorized user with the "Read...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791921187)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791921187 advisory. - Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant C...

Security Vulnerabilities fixed in Thunderbird 153.5 — Mozilla

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours...

CVE-2026-110249: Undefined Security Weakness

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5...

PT-2026-111865

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.5 Thunderbird versions prior to 158 Description A compromised or MITM-controlled Exchange server can send a well-formed SOAP response containing an element with an excessive number of attributes. This causes t...

microcode_ctl security, bug fix, and enhancement update

20260812-1.0.2 - disable late update for 06-ad-01 20260812-1.0.1 - enable use with ueknext and UEK8 kernels - don't bother calling dracut if virtualized - ensure UEK also rebuilds initramfs - enable early update for 06-4f-01 - enable early and late load on RHCK 4:20260812-1 - Update Intel CPU...

Ubuntu 24.04 LTS / 26.04 LTS : zlib vulnerability (USN-8706-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8706-1 advisory. It was discovered that zlib incorrectly handled negative length parameters in CRC32 combine functions. An attacker could use this issue to cause a...

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

SUMMARY Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP incl. SIPLUS variant. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not...

CLSA-2026-1791841538 nodejs: Fix of CVE-2026-9496

CVE-2026-9496: strip the committish in addGitSha of the bundled npm pacote copy with indexOf/slice instead of a backtracking regular expression, so a crafted git spec can no longer consume excessive CPU...

CLSA-2026-1791840472 nodejs: Fix of CVE-2026-9496

CVE-2026-9496: strip the committish in addGitSha of the bundled npm pacote copy with indexOf/slice instead of a backtracking regular expression, so a crafted git spec can no longer consume excessive CPU...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the applyNaive function in pkg/archive/tar.go, where each .wh..wh..opq entry triggers a full filepath.Walk of the containing directory with no record of directories already process...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the applyNaive function in pkg/archive/tar.go, where each .wh..wh..opq entry triggers a full filepath.Walk of the containing directory with no record of directories already process...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2020-37280 cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...