CVE-2026-71190

A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causin...

CVE-2026-57819

CVE-2026-57819 affects Apache CXF; there is no default limit on the number of form parameters per JAX-RS message due to the maxFormParameterCount setting. This can enable denial-of-service when processing requests with many form parameters. The connected sources state fixes by introducing a defau...

CVE-2026-57819 Apache CXF: No default restriction on the amount of form parameters per message

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...

EUVD-2026-53852

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...

EUVD-2026-53851

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

CVE-2026-54225

CVE-2026-54225 affects Apache CXF. The issue is that prior to CXF 4.2.3, 4.1.8 and 3.6.12 there was no default limit on the maximum attachment size, enabling a potential denial-of-service via large attachments. The default size limit of 50 MB is fixed in CXF 4.2.3, 4.1.8, and 3.6.12. If exploitin...

TencentOS Server 3: dovecot (TSSA-2026:0810)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0810 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Impact An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a v-for over a prop for example v-for="n in count" or a . Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props a...

CVE-2026-59675

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

CVE-2026-59675

CVE-2026-59675 affects Rancher Manager when API audit logging is enabled. The audit middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because it is positioned earlier than Rancher’s APIBodyLimitingHandler, the default 1 MiB body cap is by...

EUVD-2026-53291

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow containers July 2026

Summary In addition to updating many operating system level packages, IBM Business Automation Workflow container fixes address the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for comma-separated valu...

CVE-2026-68078

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version...

CVE-2026-67592

Removed by vendor...

CVE-2026-67592 Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2....

CVE-2026-67555

The CVE-2026-67555 entry concerns Apache Qpid Proton-Dotnet up to version 1.0.0, where the maximum number of transfer frames per incoming delivery could not be governed. This could allow an authenticated attacker to cause excessive resource usage and potential denial of service (availability impa...

CVE-2026-66277 Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version...

SUSE SLES15 Security Update : bind (SUSE-SU-2026:3476-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3476-1 advisory. This update for bind fixes the following issues - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-1133...

SUSE SLES12: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2026:3484-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3484-1 advisory. This update for bind fixes the following issues - CVE-2026-11622: Potential memory usage beyond configured limits bsc1271986. - CVE-2026-11721:...