PT-2026-82095

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.10 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 Description An authenticated user can cause a denial of service through an unbounded loop. This occurs when specially crafted input is...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: thrift (UTSA-2026-032286)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032286 advisory. In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098698)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098698 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvmetcphandler2t to ensure it's...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104548)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104548 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sgcleanup path used listi...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098757)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098757 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdifpassthruplaybackgetresources uses...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104556)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104556 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sgcleanup error path used listi...

PT-2026-89158

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An asymmetric resource consumption issue exists in the OIDC back-channel logout handler. When the ENABLE OAUTH BACKCHANNEL LOGOUT setting is enabled and an OIDC provider is configured, the...

Linux Distros Unpatched Vulnerability : CVE-2026-16599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line ...

Linux Distros Unpatched Vulnerability : CVE-2026-80532

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix another iunlink infinite loop bug in online fsck xrepiunlinkresolvebucket is supposed to reconstruct as much of the incore prev and next unlinked list...

CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

EUVD-2026-66111

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

Security Bulletin: Vulnerability in ASF (WMV/WMA) file type detection parser affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in ASF WMV/WMA file type detection parser has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for...

Security Bulletin: Vulnerability in node-tar affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in node-tar has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin: Vulnerability in protobufjs affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in protobufjs has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

CVE-2026-55373

A flaw was found in OpenEXR. An attacker could trigger an infinite loop by providing a specially crafted sample count value UINTMAX when processing image data. This vulnerability, located in the SampleCountChannel component, prevents the application from progressing, leading to a denial of servic...

CVE-2026-16599

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network...

DEBIAN-CVE-2026-16599

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network...

CVE-2026-79775

rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...

CVE-2026-16599 Denial of Service in GNU wget

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network...

CVE-2026-16599 Denial of Service in GNU wget

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network...