Important: Red Hat Security Advisory: iperf3 security update

An update for iperf3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

android-security-awesome — Updated!

android-security-awesome A collection of Android security-related resources. If you find this project useful, please consider supporting it. 1. Tools 2. Academic/Research/Publications/Books 3. Exploits/Vulnerabilities/Bugs Tools Online Analyzers 1. Appknox - not free 2. Virustotal 3. NowSecure La...

CVE-2026-82722

ash-project ash_admin (an Elixir/BEAM library) is vulnerable to node-level denial of service via its LiveView event handlers. Two handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor used Module.concat/1 on the resource/domain payload, and AshAdmin.Components.Resou...

CVE-2026-82722

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashadmin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's setacto...

ROS-20260831-73-0013

The vulnerability in golang-x-image is related to unlimited resource distribution. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the pqm_update_queue_properties() function in the drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c file of the Direct Rendering Infrastructure (DRI) driver for AMD kernel-based Linux operating systems allows a attacker to compromise the accessibility of protected information.

The vulnerability of the pqmupdatequeueproperties function in the drivers/gpu/drm/amd/amdkfd/kfdprocessqueuemanager.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems leads to unmanageable resource consumption. Exploiting this vulnerability...

The vulnerability of the mshv_handle_gpa_intercept() function in the drivers/hv/mshv_root_main.c file of the Linux operating system for Microsoft HyperV kernel driver allows a attacker to cause a service failure.

The vulnerability of the mshvhandlegpaintercept function in the drivers/hv/mshvrootmain.c file of the Microsoft HyperV Linux operating system kernel driver is related to the improper disabling or release of resources. Exploiting this vulnerability could allow a remote attacker to cause service...

PT-2026-83955

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched...

Important: tomcat

Issue Overview: Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the...

Amazon Linux 2023 : python3.14-pip, python3.14-pip-wheel (ALAS2023-2026-2093)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2093 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to...

CVE-2026-82818: Improper Access Control

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched...

Medium: python3.11-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Medium: python3.14-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Medium: python-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

PT-2026-83943

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-19873

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

CVE-2026-71257: Allocation of Resources Without Limits or Throttling

Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request body has already been consumed by another component, Commons FileUpload returns no items and Wicket falls back to reading the upload throu...

The vulnerability of the most_register_interface() function in the drivers/most/core.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the mostregisterinterface function in the drivers/most/core.c module of the Linux kernel’s firmware is related to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability could allow a perpetrator to cause service failures...

The vulnerability of the comedi_device_attach() function in the drivers/comedi/drivers.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the comedideviceattach function in the drivers/comedi/drivers.c module of the Linux kernel is related to incorrect initialization of resources. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the...