CVE-2026-57819 Apache CXF: No default restriction on the amount of form parameters per message

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...

EUVD-2026-53852

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...

CVE-2026-57819

The Apache CXF library allows for configuring the number of form parameters in a JAX-RS message via the "maxFormParameterCount" option. However, because no default limit is set, the software is susceptible to denial of service (DoS) attacks when processing requests containing a very large number ...

CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

CVE-2026-54225

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

CVE-2026-54225

Apache CXF is vulnerable to a denial of service (DoS) attack due to the lack of a default maximum attachment size via the "attachment-max-size" configuration option. If a user fails to explicitly set this limit, an attacker can exploit the vulnerability to cause resource exhaustion. This issue is...

EUVD-2026-53851

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

SUSE CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

RockyLinux 8 : kernel-rt (RLSA-2026:49851)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49851 advisory. kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: Rocky Linux8.10 - KVM: s390: Limit adapter indicator access...

EulerOS 2.0 SP15 : unbound (EulerOS-SA-2026-2954)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met...

EulerOS 2.0 SP15 : httpd (EulerOS-SA-2026-2929)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious...

TencentOS Server 3: dovecot (TSSA-2026:0810)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0810 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

RockyLinux 8 : kernel (RLSA-2026:49857)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49857 advisory. kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: Rocky Linux8.10 - KVM: s390: Limit adapter indicator access...

CVE-2026-19037: Improper Enforcement of Behavioral Workflow

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::updatelob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote...

PT-2026-68483

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the island renderer endpoint when attacker-controlled input is decoded and hashed before URL-resident hash validation. An attacker can exhaust CPU resources and degrade or stall t...

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Impact An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a v-for over a prop for example v-for="n in count" or a . Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props a...

Malicious code in bigops-products-travel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91399b954849c3483787f47cb7a54ed5784aba889c1ccafc13ff2f037b21af64 On require of the package's main entry, loader.js downloads a platform-specific binary from Cloudflare Workers hosts assembled via string-split...