CVE-2026-59295

CVE-2026-59295 affects applications using MicrometerHttpClientInterceptor to instrument Apache HttpAsyncClient (4.x or 5.x). When asynchronous requests fail before receiving a response—such as connection resets or timeouts—the per-request tracking state is never released, causing an unbounded mem...

The vulnerability in the driver/media/v4l2-core/v4l2-async.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the drivers/media/v4l2-core/v4l2-async.c component of the Linux operating system is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

FreeBSD : jackson-core -- StreamReadConstraints can be bypassed (0cb42b4a-9f19-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0cb42b4a-9f19-11f1-a655-3497f65b111b advisory. The Jackson project reports: Enforce maxNameLength incrementally in ReaderBasedJsonParser Fail parsing...

CVE-2026-59324

CVE-2026-59324...

JLSEC-2026-1351 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

The affected versions of Wasmtime can panic if the host embedder drops the future returned by wasmtime::component::TypedFunc::callasync before it resolves. Details Starting with Wasmtime 39.0.0, the component-model-async feature became the default, which brought with it a new implementation of...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102041)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102041 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks AH allocates its temporary auth/ICV layout...

Exposure of Data Element to Wrong Session

Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the fluxTransform when used with an asynchronous or reordering fluxFunction that emits raw payloads. An attacker can access another user's reply headers and cause reply mis-routing by sendin...

EUVD-2026-62700

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

CVE-2026-75143

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

CVE-2026-75143 FFmpeg Heap Buffer Overflow via RIST Protocol Reader

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

Malicious Package

Overview express-enrouten-async is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview async-mutex-v2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-78649

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

UBUNTU-CVE-2026-53533

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...

SUSE CVE-2026-74578

In the Linux kernel, the following vulnerability has been resolved: crypto: algifskcipher - force synchronous processing on trees without ctx-state The AIO/async path in skcipherrecvmsg passes the socket-wide ctx-iv directly into the skcipher request. After iosubmit the socket lock is dropped and...

CVE-2026-75851

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75851

ArcadeDB server versions 26.7.3 and earlier fail to propagate the authenticated principal to async worker threads, making the scripting authorization gate a no-op. A read-only user can submit a JavaScript command via /api/v1/command with awaitResponse:false to execute arbitrary code and create a ...

CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75851

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...