CVE-2026-78844

Summary javadelight delight-nashorn-sandbox 0.5.5 suffers from Uncontrolled Resource Consumption. The sandbox enforces maxCPUTime limits by statically injecting interruption checks into JavaScript loops, but the sandbox fails to disable dynamic code evaluation. An attacker can use these functions...

Rocky Linux 9 [CIQ] Security Update: adwaita-qt-debuginfo / adwaita-qt-debugsource / adwaita-qt5 / etc Multiple Vulnerabilities (crlsa-2023_6369)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236369 advisory. qt: buffer over-read via a crafted reply from a DNS server CVE-2023-33285 qt: allows remote attacker to bypass security restrictions caused by flaw in...

AlmaLinux 9.2 [TuxCare] Security Update: qt5-qtbase / qt5-qtbase-common / qt5-qtbase-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1764026530)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764026530 advisory. - In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReade...

CVE-2026-95604

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

EUVD-2026-85507

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-95604 WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-95604 WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-95604

The Loops & Logic WordPress plugin is vulnerable to an unauthenticated Broken Access Control flaw in versions

WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by K. Sorrachat in WordPress Plugin Loops & Logic versions = 4.2.4...

CVE-2026-84446

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could provide a crafted HEIF file containing malicious sequence timing and edit-list data. This could lead to non-terminating decode loops and unbounded memory allocation, resulting in severe CPU and...

CVE-2026-95604: Missing Authorization

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

PT-2026-97492

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-32641 Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

CVE-2026-32641 Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

WordPress Loops & Logic plugin <= 4.3.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Joshua Martinelle in WordPress Plugin Loops & Logic versions = 4.3.1...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: fixed integer types and null check locations Reason: Issues fixed: - Comparison with a wider integer type in the loop condition, which could lead to infinite loops. - Dereferencing a pointer before performing ...

Astra Linux – Vulnerability in qt4-x11, qtbase-opensource-src

A issue was discovered in Qt before version 5.15.15, in versions 6.x before 6.2.10, and in versions 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion...

Astra Linux – Vulnerability in Wireshark

Excessive loops in multiple dissectors in Wireshark versions 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 allow denial of service via packet injection or crafted capture files...

Astra Linux – Vulnerability in Wireshark

MONGO and ZigBee TLV dissector have infinite loops in Wireshark versions 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22. These bugs allow for denial of service through packet injection or with properly crafted capture files...

PT-2026-90331

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ntfs3 file system where a crafted log record can cause an overflow of the page lcns array. This occurs because the copy lcns loop and the redo shorten loop index...