164473 matches found
CVE-2026-110261 OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...
CVE-2026-110261 OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...
CVE-2026-110261
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTEFRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames fix point algorithm converge slowly,...
Inefficient Algorithmic Complexity
Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames method in MethodWriter. An attacker can exhaust CPU and tie up class-file transformation threads for an unbounded time by supplying crafted class files for processing with...
Inefficient Algorithmic Complexity
Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames method in MethodWriter. An attacker can exhaust CPU and tie up class-file transformation threads for an unbounded time by supplying crafted class files for processing with...
Inefficient Algorithmic Complexity
Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the computeAllFrames method in MethodWriter. An attacker can exhaust CPU and tie up class-file transformation threads for an unbounded time by supplying crafted class files for processing with...
CVE-2026-110261
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability caused by inefficient algorithmic complexity (CWE-407). When processing crafted class files using ClassWriter.COMPUTE_FRAMES , an attacker can supply methods that cause the MethodWriter.computeAllFrames() fix point algorithm to co...
Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.
Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-70906 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successfu...
Exploit for Path Traversal in Mikrotik Routeros
Webfig-jsproxy-unauthenticated-file-read-CVE-2026-67281- !/u...
Security Bulletin: Platform Navigator and Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in golang.org/x/crypto
Summary Platform Navigator and Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in golang.org/x/crypto. CVE-2026-56855, CVE-2026-78662 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-56855 DESCRIPTION: Previously, after a channel has be...
K000162617: NGINX Ingress Controller vulnerability CVE-2026-104939
Security Advisory Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper...
K000162613: NGINX ngx_http_v3_module vulnerability CVE-2026-95101
Security Advisory Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. CVE-2026-95101 Impact This vulnerability may...
K000162615: NGINX ngx_http_js_module vulnerability CVE-2026-101019
Security Advisory Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return...
K000162614: NGINX ngx_http_js_module vulnerability CVE-2026-101025
Security Advisory Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may sen...
K000162610: NGINX Gateway Fabric vulnerability CVE-2026-96615
Security Advisory Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and has an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticate...
K000162611: NGINX Ingress Controller vulnerability CVE-2026-94197
Security Advisory Description An authentication and authorization bypass vulnerability exists in F5 NGINX Ingress Controller when configured with the ExternalAuth policy or with Ingress external authentication. Client-supplied X-Forwarded-Prefix , X-Forwarded-URI , X-Original-URI , and...
K000162609: NGINX Gateway Fabric vulnerability CVE-2026-91184
Security Advisory Description NGINX Gateway Fabric has a vulnerability when it renders spec.basic.realm and spec.jwt.realm of a namespaced AuthenticationFilter Custom Resource Definition CRD verbatim, unescaped and unvalidated, into the shared data plane nginx.conf as authbasic "";. A namespaced...
K000162607: NGINX map directive and regex matching vulnerability CVE-2026-93479
Security Advisory Description A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result cou...
K000162606: NGINX ngx_http_ssl_module vulnerability CVE-2026-97629
Security Advisory Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared: : without an explicit sslsessionticketkey file directive to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a...
K000162608: NGINX ngx_http_core_module vulnerability CVE-2026-97205
Security Advisory Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing include virtual commands may trigger a Use-After-Free UAF...