CLEANSTART-2026-HN97324 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5

CVE-2026-71290 affects multiple packages. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...

CLEANSTART-2026-KS25235 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

CLEANSTART-2026-BD93635 It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak

Security vulnerability affects the strimzi-kafka-operator package. It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak...

CLEANSTART-2026-QG39895 undici's WebSocket client crashes the whole Node

CVE-2026-19534 affects multiple packages. undici's WebSocket client crashes the whole Node. See references for individual vulnerability details...

CLEANSTART-2026-TX86596 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...

CVE-2026-85024 affects multiple packages. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. See references for individual vulnerability details...

EUVD-2026-101755

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

Redis 8.6.2 Use-After-Free Checker

Redis versions through 8.6.2 contain a use-after-free in the unblock client flow that may lead to remote code execution. This tool queries Redis server version information and identifies versions requiring remediation...

PT-2026-114834

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send...

PT-2026-114835

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. A malicious, compromised, or man-in-the-middle MySQL server can send...

PT-2026-114986

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4B M30HG4B V260724 Description A heap-based buffer overflow exists in the api.cgi file. This issue allows a remote attacker to trigger the overflow via an unknown function. The vendor noted that the api=info&client=app handler...

CVE-2026-85747

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

CVE-2026-67414

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10common/src/amqp10binaryparser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the...

CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-97629

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

CVE-2026-88833

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causin...

Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_81406)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202681406 advisory. kernel: thermal: core: Fix thermal zone device registration error path CVE-2026-43332 kernel: macsec: fix replay protection at XPN lower-PN wrap...

DEBIAN-CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872

The Nodemailer library (versions 3.0.0 before 10.0.10) contains a quadratic complexity denial of service vulnerability within the SMTP client reply parser, specifically affecting SMTPConnection._onData and isPartialResponse. A malicious SMTP server or an on-path attacker can trigger this by strea...