261 matches found
CVE-2026-63299
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...
UBUNTU-CVE-2026-63299
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...
CVE-2026-63299
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...
CVE-2026-63299
CVE-2026-63299 is a concrete issue in LXD where an authenticated user can bypass project-level disk and volume limits. The vulnerability arises from two code paths: (1) storagePoolVolumeTypePostMove does not perform limits.AllowVolumeCreation when moving a volume across projects, and (2) volume s...
Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: AppArmor: Fixed the rlimit settings for posix cpu timers. posix cpu timers require an additional step beyond simply setting rlimit. The code should be refactored so it’s clear which code is setting the limits, and the posix cp...
IBM DataPower Gateway Denial-of-Service Vulnerability (CNVD-2026-31545)
IBM DataPower Gateway is an enterprise-level data integration and security gateway product that provides features such as API management, message routing, and protocol conversion. There is a denial-of-service vulnerability in IBM DataPower Gateway. This vulnerability stems from improper resource...
CVE-2026-12733
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations...
CVE-2026-12733
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations...
CVE-2026-12733 IBM DataPower Gateway affected by denial of service
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations...
CVE-2026-12733
IBM DataPower Gateway is affected by CVE-2026-12733 where denial of service can occur due to improper resource limitations (CWE-770). The advisory lists affected products/versions: DataPower Gateway 10.6CD (10.6.1–10.6.6), 10.6.0 (10.6.0.0–10.6.0.9), 11.0.0 (11.0.0.0–11.0.0.1), and 10.5.0 (10.5.0...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...
EulerOS Virtualization 2.10.1 : httpd (EulerOS-SA-2026-2822)
According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's modmd via OCSP response data.CVE-2026-291...
CVE-2026-47198
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because...
CVE-2026-47198
Paymenter prior to 1.5.1 is vulnerable to URL parameter injection in the Checkout component. The Checkout Livewire property $checkoutConfig is exposed via URL query parameters, and validation rules are generated only for keys defined by an extension’s getCheckoutConfig(). Undefined keys bypass va...
CVE-2026-47198
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because...
CVE-2026-54490
CVE-2026-54490 involves the websocket-driver library. Prior to version 0.7.5, when used with the permessage-deflate extension, the message size check was based on the compressed frame length rather than the decompressed size, allowing a WebSocket server/client to accept messages larger than the c...
CVE-2026-61872
A flaw was found in ImageMagick. A local user can exploit this vulnerability by supplying malformed tile geometry parameters to the TIFF encoder. This can cause a memory leak, preventing allocated memory from being released. The primary consequence is increased memory consumption, which may lead ...
websocket-driver: Resource limit bypass via message compression
Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the si...
websocket-driver: Resource limit bypass via message compression
Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the si...