CVE-2026-76151 Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)

Out-of-bounds read buffer over-read in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service application crash via an excessively large Cache-Control header value...

CVE-2026-76151

Out-of-bounds read buffer over-read in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service application crash via an excessively large Cache-Control header value...

CVE-2026-89186

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

CVE-2026-89186

ZenHive mpp (Elixir plug library) is vulnerable to sensitive information disclosure via shared HTTP caches . The MPP.Plug.verify_credential plug sets cache-control: private and a Payment-Receipt header before the wrapped application executes, but registers no register_before_send/2 callback to en...

CVE-2026-89186 mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

CVE-2026-89186 mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

EUVD-2026-80254

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

EEF-CVE-2026-89186 mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

Summary Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped...

CVE-2026-89186 mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

Multiple vulnerabilities impact AIX due to ISC BIND (CVE-2026-10723 CVE-2026-10822 CVE-2026-11331 CVE-2026-11622 CVE-2026-11721 CVE-2026-12617 CVE-2026-13204 CVE-2026-13321)

IBM SECURITY ADVISORY First Issued: Wed Sep 16 01:36:11 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/bindadvisory31.asc Security Bulletin: Multiple vulnerabilities impact AIX due to ISC BIND CVE-2026-10723, CVE-2026-10822,...

EUVD-2026-80013

Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file. This issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d23...

CVE-2026-92133: Insufficiently Protected Credentials

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

CVE-2026-75029: Asymmetric Resource Consumption (Amplification)

In a query response, an attacker may send named multiple copies of a record that should only exist once such as an SOA record. If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly...

CVE-2026-75029: Asymmetric Resource Consumption (Amplification)

In a query response, an attacker may send named multiple copies of a record that should only exist once such as an SOA record. If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly...

CVE-2026-78301: Acceptance of Extraneous Untrusted Data With Trusted Data

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

CVE-2026-89836: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...

Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

PT-2026-93803

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the theme localization endpoints of the keycloak-services component, which manages authentication flows and themes. The system accepts arbitrary locale tags from...

PT-2026-93736

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1 Description A flaw in named occurs...

PT-2026-93900

Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.8 Description The CORS plugin in the @orpc/server package, specifically within packages/server/src/plugins/cors.ts, incorrectly copies the Vary request header from the client directly into the response. The Vary...