AZL-99318 CVE-2026-56855 affecting package packer for versions less than 1.9.5-21

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

CVE-2026-56855

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99168 CVE-2026-56855 affecting package cf-cli for versions less than 8.7.11-9

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99309 CVE-2026-56855 affecting package nvidia-container-toolkit 1.17.8-4

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

CVE-2026-56855

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

CVE-2026-56855 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

EUVD-2026-70267

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

GO-2026-6323 klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go

klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

CVE-2026-53670

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

CVE-2026-63020

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility we...

CVE-2026-63020

CVE-2026-63020 is a CWE-451 (UI Misrepresentation of Critical Information) vulnerability in the BIG-IP Configuration utility web interface. An attacker can trick authenticated users into clicking malicious links, causing a spoofed error message to be reflected in the victim's browser session. Thi...

CVE-2026-63020 BIG-IP Configuration utility vulnerability

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility we...

CVE-2026-63020 BIG-IP Configuration utility vulnerability

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility we...

EUVD-2026-70135

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility we...

DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution

A flaw was found in DBI, a Perl database interface. This vulnerability allows an attacker to trigger a buffer overflow by manipulating error messages within an application. When specific error handling options are active, an attacker can provide oversized error text, which may lead to arbitrary...

GHSA-CW6X-M8JW-QMRH NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

Summary nltk.featstruct.FeatStructReader used by FeatStructstr and by FeatureGrammar.fromstring parses feature-structure strings such as a=1 with a recursive-descent parser that has no nesting-depth limit. A small, trivially-crafted input 700 bytes with deeply nested brackets drives the parser pa...

K000161728: BIG-IP Configuration utility vulnerability CVE-2026-63020

Security Advisory Description A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. CVE-2026-63020 Impact An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in...

Malicious code in apollo-client-error-template (npm)

Source: ossf-package-analysis fe552e4b70220e1bb21d16486e988a993baf13fe78babd1d269cea3a7a765954 The OpenSSF Package Analysis project identified 'apollo-client-error-template' @ 2.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in analyze-meta-error-chi-serialize (npm)

Source: amazon-inspector 38af8bd8e647f4b19c41cc9074e2ad04540c78db7931d6d32f603a36b415cec4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

SUSE CVE-2026-72361

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hwengine: Fix double-free of managed BO in error path The error path in hwengineinit explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup action...