CVE-2026-80672

CVE-2026-80672 is a u16 truncation in the Linux kernel's in-kernel NTFS driver, specifically in ntfs_check_restart_area(). The variable ra_len is declared as u16, but the computed length of the $LogFile log client record array can exceed 65535 (e.g., log_clients of 410 yields 65600), causing trun...

PT-2026-83343

Name of the Vulnerable Software and Affected Versions Arc versions 26.02.1 through 26.06.1 Description Arc Enterprise clustering allows cluster join requests without authentication when cluster.enabled is set to true but cluster.shared secret is not configured. A network attacker who can reach th...

PT-2026-83245

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

GHSA-8X48-8G7J-RQXP Duplicate Advisory: Quadratic-time DoS in PorterStemmer via long runs of 'y'

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ww6m-cw3f-q94g. This link is maintained to preserve external references. Original Description nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of...

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-59276 Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-59276 Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-59276 Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

EUVD-2026-67168

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-59276

Spring Security is affected by a timing attack vulnerability in several components that compare security-sensitive values using standard String.equals() instead of a constant-time comparison. Because String.equals() returns as soon as a differing character is found, the response time for rejectin...

Inefficient Algorithmic Complexity

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the PorterStemmer.stem path in nltk/stem/porter.py. An attacker can pin a CPU core by supplying a single...

CVE-2026-81722

nltk PorterStemmer in versions ≤ 3.10.2 is vulnerable to an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The root cause is that the _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for ea...

CVE-2026-81722 nltk PorterStemmer before 3.10.3 Quadratic-time DoS

nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...

CVE-2026-81722 nltk PorterStemmer before 3.10.3 Quadratic-time DoS

nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...

CVE-2026-81722 nltk PorterStemmer before 3.10.3 Quadratic-time DoS

nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...

CVE-2026-59641

A flaw was found in Bouncy Castle for Java. The S/MIME Secure/Multipurpose Internet Mail Extensions validator improperly trusts the signing time asserted by the signer during path validation. This could allow an attacker to bypass certificate path validation, potentially leading to the acceptance...

New Instagram and Facebook rules set a default two-hour limit for teens

Meta decided that discretion was the better part of valor on Wednesday, agreeing to settle a landmark child safety case for up to $17 billion. The agreement would introduce a default two-hour daily limit for teens on Instagram and Facebook, overnight restrictions, and a range of other protections...

SUSE CVE-2026-74749

In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes rseqgranttimesliceextension with interrupts enabled. If the extension is granted it invokes hrtimerrearmdeferredtif to ensure that a pending...