CVE-2026-81563

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This...

CVE-2026-76553

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

EUVD-2026-80178

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-19668: Inefficient Algorithmic Complexity

A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through...

CVE-2026-81563: Missing Release of Memory after Effective Lifetime

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This...

Linux Distros Unpatched Vulnerability : CVE-2026-19668

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default...

CVE-2026-80919

A flaw was found in the Linux kernel's drm/amdgpu component. A local attacker could trigger a hung job, causing the amdgpudevcoredumpformat function to recursively acquire a lock. This recursive locking can lead to a self-deadlock, resulting in a Denial of Service DoS where the system becomes...

EUVD-2026-78898

IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...

CLEANSTART-2026-OE08543 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Multiple security vulnerabilities affect the prometheus-node-exporter-fips package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

OESA-2026-3815 pcre2 security update

PCRE2 is a re-working of the original PCRE1 library to provide an entirely new API. Since its initial release in 2015, there has been further development of the code and it now differs from PCRE1 in more than just the API. PCRE2 is written in C, and it has its own API. There are three sets of...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the transformation of search requests into backend queries, where the Realms filter may be rendered empty for non-recursive searches. An attacker can access unauthorized data by crafting specific non-recursive...

CVE-2026-90929

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-73579

Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search...

CVE-2026-73579

CVE-2026-73579 is an Incorrect Authorization vulnerability in Apache Syncope . When non-recursive search requests are processed, the Realms filter —which enforces requester permissions—can be rendered as empty, effectively bypassing privilege restrictions and exposing data the requester should no...

CVE-2026-73579 Apache Syncope: Non-recursive Any search could skip Realms restrictions

Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search...

EUVD-2026-77462

Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search...

EUVD-2026-77447

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: fixed a recursive semaphore deadlock in the fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on the FSIOCFIEMAP of the extent list in a specially crafted mmap file. contextswitch...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fixed recursive locking in configfsopenfile. In flushwritebuffer, the variable &p-fragsem is acquired, and then the loaded store function is called—specifically, targetcoreitemdbrootstore. This function calls...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: net: openvswitch: Fixed a leak of nested actions. When parsing user-provided actions, the openvswitch module may dynamically allocate memory and store pointers in the internal copy of the actions. This memory must be freed whe...