CVE-2026-92003
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure b
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Sep 15, 2026 · Last modified: Sep 15, 2026 · CWE-400 · CWE-770
Not enough EPSS history yet.
Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-908784.3 MED—
——0A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.9hCVE-2026-127596.5 MED—
——0IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption.16hCVE-2026-845537.5 HIG—
——0A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause a denial-of-service.15hCVE-2026-13260——
——0IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.17hCVE-2026-542474.3 MED—
——0Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22.18hCVE-2026-174636.5 MED—
——0IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.17h