TencentOS Server 3: resource-agents (TSSA-2026:0899)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0899 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-81699: Allocation of Resources Without Limits or Throttling

opensslencrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust syst...

PT-2026-82560

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...

CVE-2026-81521: Improper Control of Resource Identifiers

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...

CVE-2026-59315: Uncontrolled Resource Consumption

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

CVE-2026-30073: Allocation of Resources Without Limits or Throttling

An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2026-47879: Server-Side Request Forgery (SSRF)

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier...

CVE-2026-80212: Allocation of Resources Without Limits or Throttling

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...

PT-2026-82398

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier...

The vulnerability of the scx_cgroup_init() function in the kernel/sched/ext.c module, which is part of the Linux operating system’s resource management framework, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the scxcgroupinit function in the kernel/sched/ext.c module, which is part of the Linux kernel’s resource management subsystem, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the openapi3filter.sliceMapToSlice() function in the kin-openapi file handling library allows a attacker to cause a service failure.

The vulnerability of the openapi3filter.sliceMapToSlice function in the kin-openapi file handling library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-75337

The static resource interface /api/static{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to a path traversal attack. The root cause is the lack of normalization when concatenating user-controlled paths to the preview root directory. This flaw allows anonymous attackers to read sensitive file...

TencentOS Server 3: resource-agents (TSSA-2025:1035)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1035 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

PT-2026-82600

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description Insufficient validation of key derivation function KDF costs in crafted files allows attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. By supplyin...

CVE-2026-59282: Uncontrolled Resource Consumption

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

ROS-20260827-73-0022

The vulnerability of the zcdncreate function in the drivers/s390/crypto/zcryptapi.c module of the Linux S390 kernel-based cryptography driver lies in the absence of any restrictions or regulations regarding resource allocation. Exploiting this vulnerability could allow a hacker to cause service...

CVE-2026-59289: Allocation of Resources Without Limits or Throttling

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

CVE-2026-30070: Allocation of Resources Without Limits or Throttling

An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-47881: Uncontrolled Resource Consumption

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume...

ROS-20260827-73-0013

The vulnerability of the mhiinitmmio function in the drivers/bus/mhi/host/init.c file of the MHI bus driver for Linux operating systems is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...