CVE-2026-73321

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser . Authenticated attackers can submit a single post with deeply nested BBCode tags sufficient to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitors ren...

CVE-2026-11573

Uncontrolled recursion CWE-674 in the QDomDocument/QDomNode serialization path of the Qt XML module QtXml, qtbase. QDomElementPrivate::save and QDomNodePrivate::save recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error...

AZL-100947 CVE-2026-11573 affecting package qtbase 6.6.3-5

Uncontrolled recursion CWE-674 in the QDomDocument/QDomNode serialization path of the Qt XML module QtXml, qtbase. QDomElementPrivate::save and QDomNodePrivate::save recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error...

Security Bulletin: Eclipse parsson security vulnerability in IBM Content Cortex reported for BAI-EVENTS-JAVA-SDK

Summary Eclipse parsson CVE-2026-9563 security vulnerability in IBM Content Cortex. Affected and vulnerable. Vulnerability Details CVEID:CVE-2026-9563 DESCRIPTION: In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the...

CVE-2026-11573 Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

Uncontrolled recursion CWE-674 in the QDomDocument/QDomNode serialization path of the Qt XML module QtXml, qtbase. QDomElementPrivate::save and QDomNodePrivate::save recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error...

EUVD-2026-72717

Uncontrolled recursion in Qt's QDomDocument serialization QtXml lets deeply nested untrusted XML crash the app via stack exhaustion DoS only...

CVE-2026-11573

CVE-2026-11573 affects Qt's QtXml module, specifically QDomDocument::toByteArray(). The root cause is uncontrolled recursion when serializing deeply nested untrusted XML (e.g., an SVG file), which exhausts the call stack and crashes the application. The impact is limited to denial of service (ava...

CVE-2025-27237

CVE-2025-27237 Local privilege escalation vulnerability in Zabbix Agent/Agent2 for Windows via OpenSSL configuration file hijacking. Overview Field| Value ---|--- CVE ID| CVE-2025-27237 CVSS v4.0| 7.3 HIGH CWE| CWE-427: Uncontrolled Search Path Element Type| Local Privilege Escalation Vendor|...

PT-2026-88630

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

Adobe Photoshop 26.x < 26.11.7 / 27.x < 27.7 Multiple Vulnerabilities (APSB26-130)

The version of Adobe Photoshop installed on the remote Windows host is prior to 26.11.7/27.7. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-130 advisory. - Integer Overflow or Wraparound CWE-190 potentially leading to Arbitrary code execution CVE-2026-75771,...

PT-2026-87167

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources...

Adobe Photoshop 26.x < 26.11.7 / 27.x < 27.7 Multiple Vulnerabilities (macOS APSB26-130)

The version of Adobe Photoshop installed on the remote macOS or Mac OS X host is prior to 26.11.7/27.7. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-130 advisory. - Integer Overflow or Wraparound CWE-190 potentially leading to Arbitrary code execution...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Neethi (CVE-2026-66142,CVE-2026-66143 & CVE-2026-66144)

Summary IBM App Connect Enterprise runtime is vulnerable to a denial of service due to Apache Neethi. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which ma...

CVE-2026-40345

deepmerge-ts 8.0.0: recursive object graph DoS I reproduced a stack exhaustion bug in deepmerge-ts versions before 8.0.0. The interesting part is that the crash does not need a huge nested object. It comes from object identity. If both values being merged point back to themselves through the same...

ROS-20260907-73-0526

The vulnerability in Java-17-openJDK is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260907-73-0525

The vulnerability in Java-11-openjdk is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell Exploitation Lab CVE-2021-44228 Reproduced the Lo...

CVE-2026-86255

wger (versions before 2.5 ) fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. The date_sequence computation triggered via routine detail endpoints forces the server to iterate thousands of times per re...

CVE-2026-86255 wger before 2.5 Uncontrolled Resource Consumption via date_sequence

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the datesequence computation via routine detail endpoints, forcing the server to iterate thousands of times per...

CVE-2026-17440

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to cause a denial of service due to uncontrolled recursion...