PT-2026-83503

Cleartext Storage of Sensitive Information vulnerability in ash-project ash paper trail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated versio...

SUSE CVE-2026-42391

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

EUVD-2026-67960

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001485 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card release The current 6fire code tries to release the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001401)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001401 advisory. In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmciresourceremove When removing a resource fr...

CVE-2026-82456: Binding to an Unrestricted IP Address

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

Unity Linux 20.1070e Security Update: rubygem-websocket-driver (UTSA-2026-104957)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104957 advisory. Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the...

CVE-2026-77037

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...

CVE-2026-3686

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources...

CVE-2026-3686 Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources...

CVE-2026-3686

IBM Cloud Pak for Data System versions 11.3.0.2 through Interim Fix 001 are vulnerable to a denial of service caused by improper limitation of resources . The CVSS v3.1 base score is 6.2 (MEDIUM) with a local attack vector, no privileges required, and high availability impact but no confidentiali...

CVE-2026-3686 Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources...

CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...

CVE-2026-55247 plone.app.event: Denial of service via iCalendar import

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

CVE-2026-55247 plone.app.event: Denial of service via iCalendar import

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

CVE-2026-55247 plone.app.event: Denial of service via iCalendar import

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

Summary A malicious OCI registry can return a cyclic referrer graph e.g. A - A or A - B - A. The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service. This affects oras discover...

SUSE CVE-2026-72100

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a bug if the bio is out of limits If dmintegritychecklimits fails, the code would exit with DMMAPIOKILL. However, the range would be already locked at this point, and it wouldn't be unlocked, resulting in a...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...