CVE WatchOct 20, 2026

CVE-2026-113619

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are render

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 20, 2026 · Last modified: Oct 20, 2026 · CWE-400

EPSS · 30d

Not enough EPSS history yet.

Technical description

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1129155.5 MED

—

———filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-instance opening, and versions from 3.30.0 repeat the exposure on every acquisition. This issue is fixed in version 4.2.1.3h CVE-2026-1134016.5 MED

—

———Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.3h CVE-2026-108062—

—

———Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.7h CVE-2026-112400—

—

——0Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.3h CVE-2026-1123005.3 MED

—

——0A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.21h CVE-2026-1127827.5 HIG

—

——0Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.22h