CVE-2026-76992: Allocation of Resources Without Limits or Throttling

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a...

ROS-20260930-73-0028

The vulnerability of the tiam335xxbarrouteallocate function in the drivers/dma/ti/dma-crossbar.c module of the Linux kernel’s DMA driver relates to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability allows a remote attacker to cause service...

ROS-20260930-73-0019

The vulnerability of the btrfs/tree-log.c component in the Linux operating system’s kernel is related to improper handling of conflicting special elements. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0045

The vulnerability of the nfs4ffallocdeviceidnode function in the fs/nfs/flexfilelayout/flexfilelayoutdev.c module, which is part of the NFS client support in Linux operating systems, is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause servic...

ROS-20260930-73-0062

The vulnerability in the kernel-lt is related to the failure to release resources after their useful period has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...

PT-2026-103129

Name of the Vulnerable Software and Affected Versions Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4 Description Apache WSS4J fails to properly validate bounds for derived-key lengths and offsets provided by a user. This flaw allows...

PT-2026-103135

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

ROS-20260930-73-0061

The vulnerability in the kernel-lt is related to the failure to release resources after their useful period has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...

CVE-2026-102392: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-18145: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in the spamBlocker spamd service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request...

PT-2026-103543

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An endpoint used during the initial appliance setup lacks authentication and fails to correctly enforce its intended state precondition. This allows an...

CVE-2026-97291: Deserialization of Untrusted Data

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-101881: Allocation of Resources Without Limits or Throttling

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

AlmaLinux 9.2 [TuxCare] Security Update: iputils / iputils-ninfod (ALMALINUX9.2:CLSA-2025:1753987674)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753987674 advisory. - ping in iputils before 20250602 allows a denial of service application error or incorrect data collection via a crafted ICMP Echo Reply...

CVE-2026-100274: Allocation of Resources Without Limits or Throttling

In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template...

CVE-2026-100508: Allocation of Resources Without Limits or Throttling

Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...

CVE-2026-103101: Allocation of Resources Without Limits or Throttling

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...

PT-2026-103496

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

CVE-2026-102984: Uncaught Exception

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

CVE-2026-92870: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination...