CVE-2026-58389

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

BIT-OPENBAO-2025-55003 OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao's Login Multi-Factor Authentication MFA system allows enforcing MFA using Time-based One Time Password TOTP. Due to...

PT-2026-65041

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by...

PT-2026-65371

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea...

CVE-2026-45112: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Potential memory usage beyond configured limits

...

Linux Distros Unpatched Vulnerability : CVE-2026-50045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

CVE-2026-64232 block: recompute nr_integrity_segments in blk_insert_cloned_request

In the Linux kernel, the following vulnerability has been resolved: block: recompute nrintegritysegments in blkinsertclonedrequest blkinsertclonedrequest already recomputes nrphyssegments against the bottom queue, because "the queue settings related to segment counting may differ from the origina...

GHSA-4W2J-M93H-CJ5J Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

Summary The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order through an AsyncRead impl for example will be sensitive to peers that send fragments whil...

PT-2026-64278

Name of the Vulnerable Software and Affected Versions dbus-broker affected versions not specified Description A flaw exists where EMFILE/ENFILE errors, which occur when the process file-descriptor limit is reached during peer setup specifically involving SO PEERPIDFD, are treated as fatal failure...

CVE-2026-8287

Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation. This issue affects Online Pre-Accounting Software: through 17072026...

CVE-2026-65895

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...

CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...

CVE-2026-65895

CVE-2026-65895 affects Grav API Plugin prior to 1.0.10. The issue allows an authenticated user with the api.config.write privilege to modify security-critical plugin configuration scopes, namely rate limiting and CORS. This can disable site-wide rate limiting (facilitating credential brute-forcin...

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

ImpactDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the PageInfo component of Google Chrome before version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Low...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules multer, form-data, protobufjs and tar. Vulnerability Details...

CVE-2026-21723

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...