CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in convertParseError in openapi3filter/validationerrorencoder.go. An attacker can crash a server by sending a malformed multipart/form-data request body that triggers validation and is rendered through...

CVE-2026-76905 kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CVE-2026-50288

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when new URL throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now...

CVE-2026-50288 @asymmetric-effort/specifyjs: URL parse failure silently allows request

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when new URL throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now...

GHSA-R5PQ-6CHH-J3XP Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Summary An unauthenticated POST to any OpenAPI-validated endpoint, including the anonymous POST /edge/validate and POST /edge/issue-token, crashes the entire Unleash server with one request body of deeply-nested JSON. When request-body validation fails, Unleash builds the error message by calling...

NPM: Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

NPM: Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter vulnerability discovered by ? in WordPress Npm unleash-server versions 7.5.2...

Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Summary An unauthenticated POST to any OpenAPI-validated endpoint, including the anonymous POST /edge/validate and POST /edge/issue-token, crashes the entire Unleash server with one request body of deeply-nested JSON. When request-body validation fails, Unleash builds the error message by calling...

CVE-2026-53794

A flaw was found in rsync. A logic error in the --max-alloc handling allows a remote attacker to disable memory allocation sanity checks by setting --max-alloc=0. This can lead to the receiver attempting unbounded memory allocations, potentially exhausting available memory and causing a denial of...

CVE-2026-74487

A flaw was found in the binfmtmisc component of the Linux kernel. When a binfmtmisc entry is registered with the MISCFMTOPENFILE flag, it opens an interpreter file and denies write access. Upon removal of this entry, the write access is not properly restored. This oversight can lead to a persiste...

SUSE CVE-2026-68240

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drmgpusvmgetpages only stored the local dpagemap into svmpages-dpagemap on the success path. If a later page failed e.g. -EOPNOTSUPP when ctx-allowmixed is...

SUSE CVE-2026-72188

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfslookupinodebyname ntfslookupinodebyname returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an...

ROS-20260821-73-0012

The vulnerability of the functions rtw89coreregisterhw and rtw89pciprobe in the driver module net/wireless/realtek/rtw89/core.c of the Realtek wireless adapter driver in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can...

Oracle Linux 8 : cups-filters (ELSA-2026-57451)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57451 advisory. 1.20.0-36.0.1.el810.1 - header/footer not being printed in banner page. Orabug: 28265099 [email protected] - Fixes Orabug: 29163824 source indentation not...

CVE-2026-33333: Generation of Error Message Containing Sensitive Information

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3...

CVE-2026-53656: Origin Validation Error

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-50288: Server-Side Request Forgery (SSRF)

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when new URL throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now...

CVE-2026-63462: Uncontrolled Recursion

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

ROS-20260821-73-0053

The vulnerability of the hcisuspendnotifier function in the net/bluetooth/hcicore.c file of the Linux kernel’s Bluetooth subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

PT-2026-79490

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web based IT service management tool. The software contains an issue where sensitive information is disclosed within error messages, specifically involving the 'ajax.render.php...