Important: rclone

Issue Overview: The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback,...

Important: freeipmi

Issue Overview: FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses. CVE-2026-85504 Affected Packages: freeipmi Note: This advisory is applicable to...

Important: 389-ds-base

Issue Overview: A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching...

Important: exiv2

Issue Overview: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server WebReady/Curl builds CVE-2026-68546 Affected Packages: exiv2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

PT-2026-99938

Name of the Vulnerable Software and Affected Versions Axios versions 1.13.0 through 1.19.x Description HTTP/2 request setup fails to consistently apply proxy settings and caller-supplied DNS lookup policies. When an HTTPS request is configured with httpVersion: 2 and uses config.proxy or...

CVE-2026-101898: Server-Side Request Forgery (SSRF)

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

Important: ipa

Issue Overview: A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject...

PT-2026-99853

Name of the Vulnerable Software and Affected Versions elixir-mint versions 0.1.0 through 1.10.x Description A resource allocation issue allows a malicious HTTP/2 server to force a client to buffer up to approximately 16 MiB per connection in frames that should be rejected, leading to excessive...

CLSA-2026-1790522895 TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 6.13.0-tuxcare.2...

SUSE SLES16 Security Update : libsoup (SUSE-SU-2026:23857-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23857-1 advisory. - CVE-2026-85197: heap use-after-free in HTTP/2 client ondataread via GOAWAY during body upload bsc1279238. - CVE-2026-85534: heap...

CLSA-2026-1790461115 TuxCare security update for vm2 (4 CVEs)

TuxCare rebuilt vm2 to address 4 CVEs. Fixed in 3.11.5-tuxcare.2...

CLSA-2026-1790458381 TuxCare security update for vite (1 CVE)

TuxCare rebuilt vite to address 1 CVE. Fixed in 4.1.5-tuxcare.2...

CVE-2026-100661 Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

CLSA-2026-1790413013 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 8.2.3-tuxcare.2...

CLEANSTART-2026-NW24142 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-YT70018 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the loki package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

PT-2026-99332

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final Description A denial-of-service issue exists in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger that fails to bound the number of continuation bytes processed. A...

PT-2026-107345

TuxCare rebuilt 16 @angular packages to address 2 CVEs. Fixed in 4.4.7-tuxcare.12...

Exploit for CVE-2026-86350

abraxaslabs.tech · github.com/abraxas ·&...

AZL-105320 CVE-2026-67407 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...