PT-2026-92150

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and...

PT-2026-92358

In smmu detach dev nested of arm-smmu-v3.c, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

RHEL 10 : goose update (Important) (RHSA-2026:67593)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67593 advisory. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258...

PT-2026-92087

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory an...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-55091

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...

CVE-2026-55091 flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...

CVE-2026-55091 flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...

EUVD-2026-77691

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...

CVE-2026-55091

flat-to-nested (NPM, versions ≥1.1.0, ≤1.1.1) is vulnerable to prototype pollution (CWE-1321) in FlatToNested.prototype.convert (index.js). The function uses attacker-controlled id and parent field values directly as keys in plain objects, so a value of "__proto__" resolves via the prototype chai...

CVE-2026-55091 flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...

CVE-2026-57579

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesControllernested in app/controllers/alchemy/api/pagescontroller.rb returns an unfiltered pag...

EUVD-2026-77637

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesControllernested in app/controllers/alchemy/api/pagescontroller.rb returns an unfiltered pag...

CVE-2026-57579 Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesControllernested in app/controllers/alchemy/api/pagescontroller.rb returns an unfiltered pag...

CVE-2026-57579 Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesControllernested in app/controllers/alchemy/api/pagescontroller.rb returns an unfiltered pag...

CVE-2026-86349

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.8, 10.11.x = 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service CPU resource exhaustion via a crafted post containing deeply nested...

CVE-2026-75015 Apache Syncope: Nested secrets leak cleartext into audit records readable

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache...

Security Bulletin: Security vulnerability in IBM Java SDK affects WebSphere Service Registry and Repository due to July 2026 CPU (CVE-2026-16440)

Summary Security vulnerability in IBM SDK Java Technology Edition, used by WebSphere Service Registry and Repository has been addressed. This issue is also addressed by WebSphere Application Server shipped with WebSphere Service Registry and Repository. Vulnerability Details CVEID:CVE-2026-16440...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 7.1.2-15 and 6.9.13-40, Magick failed to detect multi-layer nested MVG conversions to SVG, which could lead to DoS Denial of Service attacks. Versions 7.1.2-15 and 6.9.13-40 include a...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Warns when a triple fault assertion never “escapes” from L2 The warnings are removed because they perform a sanity check that ensures KVM never allows a triple fault in L2 to escape and end up in L1. In normal operation...