CVE-2026-42391: Uncontrolled Resource Consumption

An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by...

CVE-2026-27852: Uncontrolled Resource Consumption

An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit...

CVE-2026-52687: Uncontrolled Resource Consumption

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all...

PT-2026-83020

In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bio set for iomap split ioend iomap split ioend can split bios that already come from iomap ioend bioset and thus deadlock when the bioset is exhausted. Add a separate bio set to avoid this deadlock. Christi...

ROS-20260828-73-0004

The vulnerability in the kernel-lt is related to the failure to release resources after their useful period has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...

CVE-2026-82256: Uncontrolled Resource Consumption

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

The vulnerability of the uvc_start_streaming_video() function in the drivers/media/usb/uvc/uvc_queue.c file of the Linux operating system’s multimedia device driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the uvcstartstreamingvideo function in the drivers/media/usb/uvc/uvcqueue.c file of the Linux operating system’s multimedia device driver relates to the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker to...

The vulnerability of Microsoft PowerPoint presentation preparation programs, Microsoft Office packages, and 365 Apps for Enterprise, related to incomplete cleaning of temporary or auxiliary resources, allows attackers to disclose protected information.

The vulnerability of Microsoft PowerPoint presentation preparation programs, Microsoft Office packages, and 365 Apps for Enterprise lies in incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow attackers to disclose protected information...

ROS-20260828-73-0022

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

Security Bulletin: Security Vulnerability in Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-5115)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Jetty Vulnerability Details CVEID:CVE-2025-5115 DESCRIPTION: In Eclipse Jetty, versions =9.4.57, =10.0.25, =11.0.25, =12.0.21, =12.1.0.alpha2, an HTTP/2 client may trigger the server to send...

CVE-2026-81524

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses WebSphere Application Server Liberty which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor component uses WebSphere Application Server Liberty which is vulnerable to CVE-2026-5516, CVE-2026-4410. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-5516 DESCRIPTION: IBM WebSphere Application...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses ws-7.5.11.tgz which is vulnerable to CVE-2026-62389.

Summary IBM Maximo Application Suite - Monitor Component uses ws-7.5.11.tgz which is vulnerable to CVE-2026-62389. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn b...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed below in the Vulnerability Details section. This bulletin provides information about the affected components and the...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor component uses brace-expansion-1.1.16.tgz which is vulnerable to CVE-2026-14257 and CVE-2026-69152. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion through 5.0.7...

CVE-2026-59303

Spring Cloud Stream contains a vulnerability where the dynamic destination cache size is not properly bounded, affecting versions 5.0.0–5.0.2 , 4.3.0–4.3.3 , and 4.2.0–4.2.6 . The flaw allows an unbounded cache to grow, which could lead to resource exhaustion under specific conditions. The CVSS 3...

CVE-2026-59303 Dynamic destination cache size is not properly bound in Spring Cloud Stream

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59303 Dynamic destination cache size is not properly bound in Spring Cloud Stream

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

PYSEC-2026-3961

opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust syst...

SUSE CVE-2026-72384

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandleranddata, but the remove function does not clear this handler. Thi...