93620 matches found
RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 7.0.2 (RHSA-2026:76952)
The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76952 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...
CVE-2026-103008
A flaw was found in Elasticsearch. An authenticated user with read access to an index can trigger unbounded recursion by submitting a request defining a scripted runtime field that generates deeply nested geometry structures. Because the server does not enforce a recursion depth limit when...
CVE-2026-103006
A flaw was found in Elasticsearch. An authenticated remote user with read access can trigger excessive recursion by submitting a specially crafted search request with deeply nested aggregations. Processing this request exhausts server resources and causes the affected node to crash, resulting in ...
CVE-2026-102404
A flaw was found in Elasticsearch. An authenticated remote attacker with low privileges can submit a specially crafted query to the query processing engine, triggering excessive memory allocation. This uncontrolled memory growth leads to an out-of-memory crash that terminates the service node,...
CVE-2026-102408
A flaw was found in Elasticsearch. An authenticated attacker with read access to an index can cause a Denial of Service DoS by submitting queries containing specially crafted regular expressions to the ES|QL CHUNK function. Because the component does not properly restrict regular expression...
CVE-2026-80048 Sssd: sssd-kcm: local denial of service via excessive memory preallocation
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory...
CVE-2026-80048
A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.41 packages and security update
Red Hat OpenShift Container Platform release 4.20.41 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...
CVE-2026-105922
A flaw was found in vLLM. A remote attacker can exploit this vulnerability by sending manipulated input processed by the penalty handling mechanism. This triggers an unhandled failure in the token bin counting routine gettokenbincountsandmask, crashing the service and resulting in a Denial of...
CVE-2025-26466-msf
CVE-2025-26466 модуль Metasploit OpenSSH версии с 9.5p1 по 9.9p1 уязвим к DoS-атаке, истощающей память и CPU, путем отправки повторяющихся пакетов SSH2MSGPING тип 192. Это происходит до аутентификации и может привести к блокировке сервера из-за плохой обработки очередей/буферов. Дополнительная...
CVE-2026-104633
A flaw in Gitea allows for a Denial of Service (DoS) via memory exhaustion during repository migrations from another instance. The vulnerability occurs because Gitea relies on the source server's reported max_response_items (or max_response_items) to determine the end of paginated downloads. If a...
CVE-2022-36752
Описание для CVE-2022-36752 В png2webp v1.0.4 обнаружено наличие записи за пределами границ через функцию w2p. Эта уязвимость может быть использована с помощью специально созданного файла webp при обратном преобразовании формата в png. Воспроизведение Чтобы воспроизвести уязвимость, загрузите...
python: Quadratic complexity in os.path.expandvars() with user-controlled template
A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...
cpython: Python HTMLParser quadratic complexity
A denial-of-service DoS vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource...
DEBIAN-CVE-2026-106585
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...
DEBIAN-CVE-2026-104046
A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...
CVE-2026-104046
A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...
K000163557: Linux kernel vulnerability CVE-2026-43313
Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer dereference in acpiprocessorerratapiix4 In acpiprocessorerratapiix4, the pointer dev is first assigned an IDE device and then reassigned an ISA device: dev =...
