RUSTSEC-2026-0431 Unbounded memory allocation in `evtx` parsing a `.wevtcache` file

Affected versions of evtx did not bound a per-entry payload length read from a .wevtcache file before allocating a buffer sized from it, allowing a tiny crafted file to force a multi-gigabyte allocation and abort the process out-of-memory denial of service, CWE-400. Details In...

Unbounded memory allocation in `evtx` parsing a `.wevtcache` file

Affected versions of evtx did not bound a per-entry payload length read from a .wevtcache file before allocating a buffer sized from it, allowing a tiny crafted file to force a multi-gigabyte allocation and abort the process out-of-memory denial of service, CWE-400. Details In...

CLEANSTART-2026-BN17504 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

GHSA-VPP8-G58W-M8MP Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

Summary An uncontrolled-resource-consumption vulnerability CWE-400 in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with ENDSTREAM and then immediately resets the stream makes the server rou...

Security Bulletin: IBM Maximo Application Suite uses jackson-databind-2.18.10.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777.

Summary IBM Maximo Application Suite uses jackson-databind-2.18.10.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializ...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in jackson-databind (CVE-2026-89407, CVE-2026-89425)

Summary IBM Db2 Developer Extension is affected by vulnerability in jackson-databind CVE-2026-89407, CVE-2026-89425 Vulnerability Details CVEID:CVE-2026-89407 DESCRIPTION: NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions:...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in jackson-databind (CVE-2026-91776, CVE-2026-91777)

Summary IBM Db2 Developer Extension is affected by vulnerability in jackson-databind CVE-2026-91776, CVE-2026-91777 Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw,...

Security Bulletin: IBM Test Accelerator for Z uses jackson-databind-2.22.2.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777

Summary IBM Test Accelerator for Z uses jackson-databind-2.22.2.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION:...

Security Bulletin: Security vulnerability has been found in IBM Security Verify Governance Identity Manager Adapters

Summary IBM Security Verify Governance Identity Manager Adapters are affected by a security vulnerability in the jackson-core-2.22.1.jar and jackson-core-3.2.0.jar component. Vulnerability Details CVEID:CVE-2026-89407 DESCRIPTION: NumberInput.looksLikeValidNumber in FasterXML jackson-core...

Exploit for CVE-2026-107079

Systrome-Validation-Certification Security Advisory: Unvali...

CVE-2026-20356

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered...

CVE-2026-20356

The Cisco owned Open Source Snort 3 Software is subject to a software hardening release addressing multiple internally discovered vulnerabilities. These issues are categorized as uncontrolled resource consumption (CWE-400). The identified vulnerabilities could lead to a High availability impact a...

EUVD-2026-107380

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered...

CVE-2026-20356 Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered...

CVE-2026-20356 Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered...

Cisco FTD: CVE-2026-20356: Multiple Cisco Products Snort 3 Security Hardening Release: October 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered...

Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-68497

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-68497 Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbat...

Security Bulletin: IBM Guardium Data Protection is affected by a Denial-of-Service (DoS) vulnerability in Micrometer (CVE-2026-40984)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Affected versions:...

Security Bulletin: Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2024-7592 DESCRIPTION: There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that...

PT-2026-107904

Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY...