CLEANSTART-2026-JM55948 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197)

Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197...

CLEANSTART-2026-PP64708 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153...

CLEANSTART-2026-ZU18134 Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)

Security vulnerability affects the sonarqube package. Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153...

CLEANSTART-2026-RH86029 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the temporal-server package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-IC49054 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the temporal-server package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-SC51338 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-MA96870 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack

Security vulnerability affects the rundeck package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...

EUVD-2026-92807

h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access...

Use of Cache Containing Sensitive Information

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the /v1/responses endpoint, where tokensinput stores the salt on the engine input only when it is...

PT-2026-107288

Name of the Vulnerable Software and Affected Versions NVIDIA Model-Optimizer affected versions not specified Description An issue exists where an attacker may cause deserialization of untrusted data. Deserialization is the process of converting a data format, such as JSON or XML, back into an...

Missing Role-Based Access Control (RBAC) and Logical Switch Isolation on Brocade Fabric OS MAPS Violation Data API Endpoint

: A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data acros...

CVE-2026-39791: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing = 6.2.3 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-93319

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to...

Kibana 9.0.x < 9.4.7 / 9.5.x < 9.5.4 Incorrect Authorization (ESA-2026-187)

The version of Kibana installed on the remote host is 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-187 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data...

Linux Distros Unpatched Vulnerability : CVE-2026-98207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: spi: reset bytesxfered before retrying CRC failures mmcspidatado updates data-bytesxfered after each block has been transferred successfully. If a later...

PT-2026-106741

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove all and /api/mount to read cached KV data with use...

ROS-20261006-73-0208

The vulnerability of the mmppdmaresidue function in the drivers/dma/mmppdma.c file of the Linux kernel’s DMA driver relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

PT-2026-106457

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing = 6.2.3 versions...

PT-2026-106416

Name of the Vulnerable Software and Affected Versions Edwiser Bridge versions prior to 4.3.5 Description An issue exists that allows unauthenticated users to access sensitive data. Recommendations Update to a version newer than 4.3.4...

PT-2026-107157

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Incorrect authorization allows an authenticated user with privileges over a single resource to modify a data stream they are not authorized to access. This is achieved by using the Modi...