SUSE SLES12 Security Update : cups (SUSE-SU-2026:4447-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4447-1 advisory. This update for cups fixes the following issue: - CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and...

compression vulnerable to Denial of Service via memory leak on premature response close

Impact A vulnerability in compression 1.8.2 allows an attacker to trigger a Denial of Service DoS by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, s...

GHSA-VC2V-76PW-4V95 compression vulnerable to Denial of Service via memory leak on premature response close

Impact A vulnerability in compression 1.8.2 allows an attacker to trigger a Denial of Service DoS by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, s...

DNS-Mayhem-CVE-2026-41096-Deep-Dive

DNS-Mayhem-CVE-2026-41096-Análisis-en-Profundidad Análisis técnico en profundidad de CVE‑2026‑41096, un desbordamiento de montón crítico en Windows DNSAPI.dll que permite la ejecución remota de código a través de respuestas DNS manipuladas. Incluye vectores de ataque, información sobre parches y...

CVE-2026-27944

CVE-2026-27944 - Nginx UI Unauthenticated Backup Download & Decryption https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red A proof‑of‑concept PoC exploit for CVE‑2026‑27944, a critical vulnerability in Nginx...

Orion

Orion A YARA rules repository continuously updated for monitoring the old and new threats from articles, incidents responses...

siras

SIRAS v3.0 is a modern Security Incident Response Automated Simulation framework designed to manage red teaming exercises as code. You can execute controlled security simulations that test your Incident Response plan in realistic scenarios. The main goal of SIRAS is to provide red teaming exercis...

CVE-2026-105766

The Chainguard Academy (edu) website is vulnerable to an HTTPS to HTTP downgrade attack due to the use of the backend-facing $scheme variable in the nginx.conf trailing-slash directory redirect. This issue exists in versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0...

CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-77802

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

EUVD-2026-92426

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77803

Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021 , contains a front-end request desynchronization vulnerability in the proxy request forwarding component. The root cause is that the software forwards requests containing both Content-Length and Transfer-Encoding ...

CVE-2026-77802

Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021 are vulnerable to HTTP request smuggling in the proxy request forwarding component. The issue arises because the software forwards requests with multiple conflicting Content-Length headers verbatim, while only using t...

CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

Astra Linux – Vulnerability in JRuby

Before Ruby 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an HTTP Response Splitting attack was possible. An attacker could inject a crafted key and value into an HTTP response for the WEBrick HTTP server...

Astra Linux – Vulnerability in exiv2

In Exiv2, from version 0.27.1 onwards, a malicious HTTP server can cause a denial of service crash due to a NULL pointer dereference by returning a crafted response that lacks a space character...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: eir: Fixed possible crashes when using eircreateadvdata. eircreateadvdata may attempt to add EIRFLAGS and EIRTXPOWER without checking whether those values are compatible with the structure...

Astra Linux – Vulnerability in Squid

A issue was discovered in Squid 4.x before 4.15, and in 5.x before 5.0.6. If a remote server sends a certain response header via HTTP or HTTPS, it can lead to a denial of service. This header can potentially appear in legitimate network traffic...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rnbd-srv: Zero the rsp buffer before using it. Before using the data buffer to send back the response message, completely zero it. This prevents any stray bytes from being picked up by the client side when messages are exchanged...

Astra Linux – Vulnerability in Lasso

There is a denial-of-service vulnerability in the lassoproviderverifysamlsignature functionality of Entr’ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial-of-service attack. An attacker can send a malformed SAML response to exploit this vulnerability...