CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

EUVD-2026-53851

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

CVE-2026-54225

Apache CXF is vulnerable to a denial of service (DoS) attack due to the lack of a default maximum attachment size via the "attachment-max-size" configuration option. If a user fails to explicitly set this limit, an attacker can exploit the vulnerability to cause resource exhaustion. This issue is...

SUSE CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

RockyLinux 8 : kernel (RLSA-2026:49857)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49857 advisory. kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: Rocky Linux8.10 - KVM: s390: Limit adapter indicator access...

PT-2026-68483

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote...

CVE-2026-19037: Improper Enforcement of Behavioral Workflow

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::updatelob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote...

EulerOS 2.0 SP15 : unbound (EulerOS-SA-2026-2954)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met...

RockyLinux 8 : kernel-rt (RLSA-2026:49851)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49851 advisory. kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: Rocky Linux8.10 - KVM: s390: Limit adapter indicator access...

EulerOS 2.0 SP15 : httpd (EulerOS-SA-2026-2929)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious...

TencentOS Server 3: dovecot (TSSA-2026:0810)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0810 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the island renderer endpoint when attacker-controlled input is decoded and hashed before URL-resident hash validation. An attacker can exhaust CPU resources and degrade or stall t...

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Impact An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a v-for over a prop for example v-for="n in count" or a . Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props a...

Malicious code in bigops-products-travel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91399b954849c3483787f47cb7a54ed5784aba889c1ccafc13ff2f037b21af64 On require of the package's main entry, loader.js downloads a platform-specific binary from Cloudflare Workers hosts assembled via string-split...

Malicious code in devplatform-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0244bc7396ea5f52d909130a7d685fee98c0dda29cb18b82d17e8c9c90dff552 [email protected] ships an index.js whose main module requires bootstrap.js, which on load downloads a platform-specific binary payload from...

MAL-2026-12684 Malicious code in delivery-ci-unit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69ab1e8e2553a7469b1ce9a50549b0f1cb964160096693715d10643a853eade4 On require of the package, index.js loads loader.js, which reconstructs attacker-controlled hostnames from split-string fragments...

CVE-2026-59675

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

CVE-2026-59675

CVE-2026-59675 affects Rancher Manager when API audit logging is enabled. The audit middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because it is positioned earlier than Rancher’s APIBodyLimitingHandler, the default 1 MiB body cap is by...

CVE-2026-59675

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

EUVD-2026-53291

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...