CVE-2026-73541: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

CVE-2026-70802

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-50167

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

CVE-2026-50167 Kurrier: Authenticated cross-user authorization bypass in Kurrier API

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

CVE-2026-50167 Kurrier: Authenticated cross-user authorization bypass in Kurrier API

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

EUVD-2026-60958

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

CVE-2026-73834 Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

GO-2026-6105 Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources in github.com/zxh326/kite

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources in github.com/zxh326/kite...

PT-2026-77155

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the must-gather component allows certain ACM wrapper Custom Resources that embed Secret data to be collected without redaction. When an...

PT-2026-80351

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources in github.com/zxh326/kite...

CVE-2026-71139: Allocation of Resources Without Limits or Throttling

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2026-70804: Improper Access Control

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-70802: Improper Access Control

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-73834: Cleartext Storage of Sensitive Information

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

CVE-2026-50167: Authorization Bypass Through User-Controlled Key

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

CVE-2026-47628: Allocation of Resources Without Limits or Throttling

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service...

Allocation of Resources Without Limits or Throttling

Overview atomic-agents-stack is a Spec + reference implementation for vault-native, multi-runtime AI agents Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper handling of unknown models in the PRICING lookup within the...

EUVD-2026-60322

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

CVE-2026-66792

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

CVE-2026-66792

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...