CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74836

CVE-2026-74836 is an unbounded resource exhaustion vulnerability in mtrudel/bandit (Erlang HTTP/2 server library), affecting versions 0.3.4 through before 1.12.5 . When a stream's response body exceeds the HTTP/2 connection-level send window (default 65,535 bytes), the stream process blocks indef...

EEF-CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

CVE-2026-74558

A flaw was found in the Linux kernel's zero-copy ZC transmit Tx batch path. When processing network packets, the system can fail to properly reclaim memory UMEM frames if it encounters invalid or oversized packet descriptors. This can lead to resource exhaustion, where memory is not returned to...

CVE-2026-74367

A flaw was found in the ath12k Wi-Fi driver of the Linux kernel. This vulnerability arises from inconsistent internal state management during error conditions in virtual device creation. If an error occurs, the driver may not properly clear its internal state, leading to resource issues. This cou...

CVE-2026-74385

A flaw was found in the nvmet-tcp component of the Linux kernel. This vulnerability arises from ignoring the return value of a function during the TLS handshake, specifically when the network socket is not in an established state. This oversight prevents proper cleanup, leading to the leakage of...

CVE-2026-74347

A flaw was found in the Linux kernel's netfilter cttimeout component. This issue arises from the improper management of connection tracking timeout policies. When an iptables ruleset continues to reference a connection tracking timeout policy, new connection tracking entries can repeatedly attach...

EUVD-2026-63600

Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76023

Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76023

Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76023

Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76023

Google Chrome versions prior to 151.0.7922.173 are vulnerable to improper resource control within the Linux Toolkit Theming component. This flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by serving a crafted HTML page. ...

CVE-2026-67567 Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

Arbitrary Code Injection

Overview n8n-editor-ui is a Workflow Editor UI for n8n Affected versions of this package are vulnerable to Arbitrary Code Injection in the editor's resource locator link preview rendering, which inserts stored field values into URL templates without sanitizing them, so expression syntax held in a...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

CVE-2026-53569

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway

Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplicatio...