CVE-2026-92003

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other...

CVE-2026-92003

MISP (versions ≤2.5.45) contains an unthrottled authentication-failure logging flaw. Two API authentication-failure branches—requests with no authentication key and requests with an API key of incorrect length —wrote directly to the Log model, bypassing the _shouldLog() throttle used by other fai...

CVE-2026-92002 MISP: Authentication failure logging suppressed during Redis unavailability

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User-setupRedis returns false when Redis cannot be reached. The vulnerable shouldLog logic on...

CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

CVE-2026-85584

SiYuan versions before v3.8.2 are affected by a denial of service vulnerability in the publish-service Basic Auth throttle . The throttle stores failed-attempt state keyed by attacker-controlled usernames without enforcing capacity limits or eviction policies, allowing unauthenticated attackers t...

CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

SUSE CVE-2026-72132

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: blk-throttle: prevented overflow during the calculation of wait time. There is a problem identified during code review in tgwithinbpslimit; the expression 'bpslimit jiffyelapsedrnd' might cause an overflow. This issue can be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: blk-throttle: The BIOTHROTTLED flag is set when bio is throttled. 1. In the current process, all bio instances will set the BIOTHROTTLED flag after the blkthrotlbio function is called. 2. If bio needs to be throttled, the time...

UBUNTU-CVE-2026-72115

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

CVE-2026-72115

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

CVE-2026-72132

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

CVE-2026-72132 NFS: Charge unstable writes by request size, not folio size

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

EUVD-2026-58890

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

CVE-2026-72132

The CVE-2026-72132 issue affects the Linux kernel’s NFS writeback accounting. When a folio is split into multiple requests, the code could erroneously charge or uncharge NR_WRITEBACK/WB_WRITEBACK by the entire folio size for each request, inflating accounting by up to N× and potentially pushing d...

CVE-2026-72132 NFS: Charge unstable writes by request size, not folio size

In the Linux kernel, the following vulnerability has been resolved: NFS: Charge unstable writes by request size, not folio size nfsfoliomarkunstable and nfsfolioclearcommit charge and uncharge NRWRITEBACK/WBWRITEBACK by folionrpagesfolio once per request added to or removed from a commit list. Th...

CVE-2026-48071

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...

CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...