Search: “algorithms”

4 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI research 36 Research 16 Model release 14 AI industry 13 AI safety & security 13 Policy & legal 9 Tools 7 Advisory 6 Exploit / PoC 6 Industry 6 Threat actor 6 Malware 5 Vulnerability 4 Data breach 3

SeverityAll critical 2 high 15 medium 16 low 2 info 115

rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

rosbridge_library's Protocol.incoming() has quadratic CPU cost in its JSON fallback, enabling denial of service via crafted messages.

Evgenios Gkritsis disclosed an algorithmic-complexity defect in rosbridge_suite's rosbridge_library Protocol.incoming() JSON fallback path, classified as CWE-407/CWE-1050. The flaw exists in the current ros2 branch and was not removed by PR #1199, having been present since the fallback was introduced. Crafted input can drive quadratic CPU cost and cause denial of service.

oss-securityupdated Sep 14, 19:53 UTC · 2d agofirst Sep 14, 18:17 UTC · 2d agoVulnerability 3 sources1

Critical WSO2 Vulnerability Allow Hackers to Gain Full Admin Access

WSO2 discloses CVE-2026-5430 (CVSS 10.0), an unauthenticated JWT authentication bypass allowing admin account takeover across its API management products.

WSO2 disclosed CVE-2026-5430, a critical authentication bypass (CVSS 10.0; 9.8 for single-tenant deployments) in advisory WSO2-2026-5328. The flaw stems from insecure JWT processing: tokens signed with unsupported algorithms bypass authentication checks, potentially granting unauthenticated attackers administrative access. Affected products include WSO2 API Control Plane 4.5.0-4.6.0, API Manager 4.1.0-4.6.0, Traffic Manager 4.5.0-4.6.0, and Universal Gateway 4.5.0-4.6.0. Fixes are available via update levels such as API Manager 4.6.0 update 21 or by migrating to unaffected releases.

Cyber Security News15:05 UTC · 7h agoVulnerability 3 sources CVE-2026-5430

graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS via OverlappingFieldsCanBeMergedRule

Unauthenticated quadratic CPU-exhaustion DoS disclosed in graphql-go/graphql up to v0.8.1 via OverlappingFieldsCanBeMergedRule; no fixed version exists.

Evgenios Gkritsis publicly disclosed an algorithmic-complexity denial-of-service flaw in github.com/graphql-go/graphql affecting all released versions up to and including v0.8.1. The defect is triggered via the OverlappingFieldsCanBeMergedRule validation, is unauthenticated and network-reachable, and causes quadratic CPU exhaustion. No fixed version exists; the disclosure was public because the project has no private security-reporting channel or SECURITY.md.

oss-securitySep 14, 17:58 UTC · 2d agoVulnerability

Critical Dell ObjectScale Vulnerabilities Allows Malicious Users to Compromise the Affected system

Dell's DSA-2026-393 fixes ObjectScale/ECS flaws including unauthenticated deserialization RCE CVE-2026-70416 rated CVSS 10.0.

Dell advisory DSA-2026-393 (September 10, 2026) covers multiple flaws in ObjectScale and Elastic Cloud Storage (ECS). CVE-2026-70416 is a critical untrusted-data deserialization RCE (CVSS 10.0) in ObjectScale before 4.4.0.0 allowing unauthenticated remote code execution and full environment takeover, credited to researcher WinD39 (Huynh Dinh Vu). Additional issues include CVE-2025-43936 improper authentication (8.1), CVE-2026-26947 privilege management (6.7), CVE-2026-36591-style weak crypto CVE-2025-36591 (4.4), CVE-2026-76104 permission assignment DoS (5.5), plus third-party CVEs in Apache Log4j, liblzma, and the Linux kernel. Dell advises upgrading to version 4.4.0.0 or later (or 4.2.0.1) and restricting management interfaces until patched.

Cyber Security NewsSep 13, 14:43 UTC · 3d agoVulnerability CVE-2026-70416 CVE-2025-43936 CVE-2026-26947+8 CVEs2