DEBIAN-CVE-2026-66076

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...

CVE-2026-66076

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...

CVE-2026-66076

The RabbitMQ messaging and streaming broker is vulnerable to a cross-vhost information disclosure issue in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 . The root cause is that the is_authorized/2 function calls rabbit_mgmt_util:is_authorized/2, which incorrectly checks only the ma...

CVE-2026-95845 Moquette unbounded per-session message queues allow memory exhaustion

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or...

CVE-2026-95845 Moquette unbounded per-session message queues allow memory exhaustion

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or...

CVE-2026-95845

The Moquette Java MQTT broker is vulnerable to a denial of service (DoS) condition in versions prior to 0.18.1 . The root cause is the lack of a maximum length enforcement for pending per-session message queues. If a fast publisher sends messages to a slow subscriber with a full in-flight window,...

CVE-2026-95845 Moquette unbounded per-session message queues allow memory exhaustion

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or...

HTTP Request/response Smuggling

Http4s is vulnerable to HTTP request/response smuggling. The vulnerability is due to Ember’s chunk decoder accepting malformed chunk-size values with leading plus or minus signs, which allows an attacker to exploit differences in chunk-boundary parsing by intermediaries to bypass controls, poison...

PT-2026-97396

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description Moquette does not enforce a maximum length for pending per-session message queues. This allows queued messages to accumulate without bound in memory or persistent storage when a fast publisher send...

The vulnerability of the print spooler driver for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Windows Print Spooler in operating systems related to print queues is associated with buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-90286

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

DEBIAN-CVE-2026-90286

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

AZL-102119 CVE-2026-90286 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

CVE-2026-90286 drm/amdgpu/gfx6: Use PFP on the compute queues too

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

EUVD-2026-81879

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

CVE-2026-90286

CVE-2026-90286 is a Linux kernel vulnerability in the DRM/AMDGPU GFX6 driver. On GFX6 GPUs, compute rings share the same Command Processor (CP) path as the graphics ring, but the Packet Front-End (PFP) was not being correctly used on compute queues. The fix ensures PFP is used for register writes...

CVE-2026-90286: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

rabbitmq: RabbitMQ: Information disclosure via cross-vhost authorization bypass

A flaw was found in RabbitMQ. An authorization bypass vulnerability allows a management-tagged user to read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible virtual hosts vhosts. This exposes sensitive cross-tenant queue names and cluster topology...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ublkdrv: A NULL pointer dereference issue was fixed in ublkctrlstartrecovery. When two UBLKCMDSTARTUSERRECOVERY commands are submitted, the first one sets ‘ubq-ubqdaemon’ to NULL, and the second one triggers a WARN in...