https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 17:53:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-362124 EUVD-2026-362124 https://cve.radiocsirt.org/vuln/euvd-2026-362124 https://cve.radiocsirt.org/vuln/fkie_cve-2026-76763 <p>A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.</p> <p>A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-76763 https://cve.radiocsirt.org/vuln/rhsa-2026:62515 <p>io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine resteasy-core: RESTeasy SourceProvider remote unauthenticated file read org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification</p> <p>io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine resteasy-core: RESTeasy SourceProvider remote unauthenticated file read org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification</p> https://cve.radiocsirt.org/vuln/rhsa-2026:62515