bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records

A flaw was found in BIND 9. A remote attacker can exploit this vulnerability by querying a BIND resolver for the root of a specially crafted, cached tree of SVCB/HTTPS AliasMode records. This action causes the resolver to spend a disproportionate amount of CPU time constructing the response,...

PT-2026-106180

Name of the Vulnerable Software and Affected Versions Ghost versions 4.0.0 through 6.66.0 Description A crafted content import file can lead to excessive CPU usage, resulting in the Ghost server becoming unresponsive. This issue requires Administrator access to be exploited. Recommendations Updat...

CVE-2026-105646: Inefficient Regular Expression Complexity

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

PT-2026-106207

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

PT-2026-106179

Name of the Vulnerable Software and Affected Versions Ghost versions 5.37.0 through 6.66.0 Description A crafted request to the external media inliner can lead to excessive CPU usage, resulting in the server becoming unresponsive. This issue requires Administrator access to be exploited...

CVE-2026-105645: Inefficient Regular Expression Complexity

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

Linux Distros Unpatched Vulnerability : CVE-2026-103885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API like Apache DS may consume 100% of a CPU core...

CVE-2026-96288 Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-103885

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API like Apache DS may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. User...

CVE-2026-103885

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API like Apache DS may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. User...

EUVD-2026-91362

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API like Apache DS may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. User...

CVE-2026-103885 Apache Directory LDAP API: Denial of service via crafted telephone number values

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API like Apache DS may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. User...

CVE-2026-103880

The Apache Directory LDAP API is vulnerable to an Asymmetric Resource Consumption (CWE-405) vulnerability. When storing a password using the bcrypt algorithm with a high cost factor (e.g., 30), the server CPU can be forced to run for hours while checking credentials, leading to a Denial of Servic...

CVE-2026-103880 Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

EUVD-2026-91359

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

EUVD-2009-5121

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as t...

CVE-2026-104861: Uncontrolled Resource Consumption

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

PT-2026-104188

Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 2.1.0 through 2.1.8 Description An asymmetric resource consumption issue exists where a LDAP server using the LDAP API may consume 100% of a CPU core indefinitely. This occurs when the server processes...

PT-2026-104187

Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 2.1.0 through 2.1.8 Description An asymmetric resource consumption issue exists where storing a password using the bcrypt algorithm with an excessively high cost factor, such as 30, can cause the server CPU t...

SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2026:4401-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4401-1 advisory. Security issues fixed: - CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead ...