CVE-2026-67445: Uncontrolled Resource Consumption

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine using bufio.Reader.ReadString before session.parseLine parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticate...

CVE-2026-63495: Uncontrolled Resource Consumption

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

PT-2026-79065

Name of the Vulnerable Software and Affected Versions Plate versions prior to 53.3.2 Description When converting attacker-controlled HTML through the htmlToDocxBlob function in a server-side or privileged environment, the @platejs/docx-io module fetches remote image URLs. This behavior allows for...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the process that handles incoming payloads. An attacker can cause service disruption by sending specially crafted malicious payloads. Remediation Upgrade...

CVE-2026-69183: Authentication Bypass by Spoofing

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

PT-2026-79131

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.173 Description Improper resource control in Linux Toolkit Theming allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by using a crafted HT...

CVE-2026-73196: Allocation of Resources Without Limits or Throttling

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the evaluation of user-supplied SpEL expressions containing the power operator ^ with a BigDecimal or BigInteger operand and a large exponent value. An attacker can cause excessive...

PT-2026-98971

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handling of HTTP/1.1 pipelined requests over a single connection. An attacker can cause excessive memory consumption by sending multiple pipelined requests, potentially leading...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the Flux.bufferTimeout process with fairBackpressure enabled when a race condition occurs between flushing buffered items and the arrival of new upstream items. An attacker can cause the stream to hang indefinitely and...

Linux Distros Unpatched Vulnerability : CVE-2026-73196

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This...

Missing Release of Resource after Effective Lifetime

Overview org.springframework:spring-messaging is a framework and inversion of control container for the Java platform. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the RSocketMessageHandler process when handling a malformed SETUP...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SimpleEvaluationContext file when the SpEL expression compiler is enabled through specific configuration settings. An attacker can cause unbounded class-loading growth and bypa...

RHEL 9 : mod_md (RHSA-2026:57642)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57642 advisory. This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate...

PT-2026-79054

Name of the Vulnerable Software and Affected Versions jsoup versions prior to 1.23.2 Description An uncontrolled resource consumption issue exists in the XmlTreeBuilder function. A remote attacker can exhaust JVM heap memory by providing a deeply nested XML document containing uniquely-namespaced...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Allocation of Resources...

PT-2026-81889

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.39 through 9.0.120 Apache Tomcat versions 8.5.59 through 8.5.100 Description An uncontrolled resource consumption issu...