GO-2026-6488 OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga

OpenFGA: ListUsers returns a deliberately-excluded user when a but not exclusion under a type-bound wildcard is intersected and with another relation that also grants that user in github.com/openfga/openfga...

The Cost of Stability: Deanonymizing Onion Services Long-Lived Introduction Circuits

Tor is a widely used anonymity network that provides network privacy by routing client communications through a sequence of relays to their destinations. An adversary observing a single Tor relay cannot readily link clients to their destinations, as doing so requires identifying the other relays...

CVE-2026-91866

A flaw was found in Neethi. A remote attacker could exploit this vulnerability by providing specially crafted WS-Policy documents. This could force Neethi's policy-intersection to perform an exponential amount of work, leading to a denial of service DoS by consuming excessive CPU resources...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the policy-intersection. An attacker can exhaust system resources and cause service disruption by submitting specially crafted WS-Policy documents that trigger excessive...

CVE-2026-91866

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866

Apache Neethi is vulnerable to a denial of service (DoS) condition due to a flaw in its policy-intersection functionality. A remote attacker can provide a specially crafted pair of WS-Policy documents that force the system to perform an exponential amount of work, resulting in excessive CPU consu...

EUVD-2026-83888

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91866 Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

PT-2026-96083

Name of the Vulnerable Software and Affected Versions Neethi versions prior to 3.2.4 Description A specially crafted pair of WS-Policy documents can cause the policy-intersection process to perform exponential amounts of work, leading to high CPU utilization and a denial of service. Recommendatio...

CVE-2026-91866: Allocation of Resources Without Limits or Throttling

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

Description In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded. Preconditions This applies if all of the following are present: - The authorization model contains a relation defined as an intersection and where at least one operand is an exclusion of the...

CVE-2026-61709

OpenFGA prior to 1.18.1 had an authorization-decision over-inclusion flaw in the ListUsers API. When an authorization relation combined a but not exclusion under a type-bound wildcard with another relation via intersection (and), the function expandIntersection in pkg/server/commands/listusers/li...

PT-2026-51121

Name of the Vulnerable Software and Affected Versions SpiceDB versions prior to 1.54.0 Description Under concurrency, the CheckPermission and CheckBulkPermissions functions can incorrectly return PERMISSIONSHIP HAS PERMISSION instead of PERMISSIONSHIP CONDITIONAL PERMISSION for a specific resourc...

gnutls security update

An update is available for gnutls. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The gnutls packages provide the GNU Transport Layer Security GnuTLS library,...

CVE-2026-42998

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mshv: Fixed the check for overlap in memory regions. The current check was incorrect; it only checks whether the beginning or end of a region is within an existing region. This does not take into account cases where the user spac...

Loaded Dice: Solving the Non-Selection Problem for Scalable Probabilistic RowHammer Defense

DRAM scaling has exacerbated the RowHammer vulnerability. To counter this, JEDEC recently introduced Per Row Activation Counting PRAC with the Alert Back-Off protocol as an optional DDR5 feature. While promising, PRAC requires per-row counter cells that incur area overhead, and updating them on...

SUSE CVE-2025-68743

In the Linux kernel, the following vulnerability has been resolved: mshv: Fix create memory region overlap check The current check is incorrect; it only checks if the beginning or end of a region is within an existing region. This doesn't account for userspace specifying a region that begins befo...