Amazon Linux 2023 : squid (ALAS2023-2026-3145)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3145 advisory. Due to a CWE-841 Improper Enforcement of Behavioral Workflowbug Squid is vulnerable to a Request Smuggling attack againstHTTP/1.1 Transfer-Encoding. This problem allows a trusted client to perform an...

Linux Distros Unpatched Vulnerability : CVE-2026-54875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms...

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

Summary Nodemailer's process-global DNS cache is keyed only by host, but each cache entry also stores the caller-specific TLS servername. When two direct SMTPS transports use the same DNS host with different tls.servername values, the first transport's server name is returned to the second...

NPM: Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

NPM: Nodemailer: Process-global DNS cache reuses TLS servername across transports, enabling cross-tenant SMTP credential disclosure vulnerability discovered by ? in WordPress Npm nodemailer versions = 5.0.0, 10.0.2...

GHSA-6VJ9-MWQ6-2F5V Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

Summary Nodemailer's process-global DNS cache is keyed only by host, but each cache entry also stores the caller-specific TLS servername. When two direct SMTPS transports use the same DNS host with different tls.servername values, the first transport's server name is returned to the second...

CVE-2026-101917

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

UBUNTU-CVE-2026-101917

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

CVE-2026-97026

Flatpak creates temporary child repository directories within the user cache using world-writable permissions (0777) . On multi-user systems with a permissive umask, this flaw allows other local users to read or modify the temporary directories used during the installation of applications or runt...

CVE-2026-97026 Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

CVE-2026-97026 Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

EUVD-2026-88553

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

CVE-2026-97025

The Flatpak application is vulnerable to a local information disclosure flaw where it writes the OCI repository authentication token with world-readable permissions (0644 ) in the system-helper's cache directory. This allows other local users on a multi-user system to read the token and impersona...

CVE-2026-97025 Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-97026

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

kernel: arm64: tlb: Flush walk cache when unsharing PMD tables

A flaw was found in the Linux kernel, specifically within the arm64 architecture's Translation Lookaside Buffer TLB management. When a Page Middle Directory PMD table was unshared, the TLB flush operation did not correctly invalidate entries in the walk cache. This oversight could leave stale PMD...

CVE-2026-101917 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

CVE-2026-101917

The PyJWT Python library (prior to version 2.14.0 ) is vulnerable to a denial-of-service vector due to how it handles unknown keys in the get_signing_key_from_jwt function. Because the library lacks a negative cache or minimum refresh interval, repeated requests using unknown or varying kid value...

CVE-2026-98005

A flaw was found in the Linux kernel's EROFS Enhanced Read-Only File System component. Due to a missing delimiter between the domain identifier and fingerprint when generating cache keys for shared inodes, the resulting cache entries are ambiguous. A local user could exploit this ambiguity to cau...

CVE-2026-101904

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

CVE-2026-91154

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...