CVE-2026-76560

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

CVE-2026-76560

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

CVE-2026-54171

A flaw was found in Excon, a Ruby HTTP client library. The RedirectFollower middleware, responsible for handling redirects, failed to remove sensitive header information when a request was redirected to a new target. This oversight could lead to the unintended exposure of confidential data to an...

EUVD-2022-56042

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

CVE-2026-76578

FreeIPA is affected by a critical flaw (CVSS 9.8 ) in its self-managed OTP token ACI , which does not require authentication and fails to restrict which attributes may be added alongside a token entry. Combined with a related flaw in the underlying directory server's ACI evaluation (tracked separ...

Veto v2.3

Veto An open source VirusTotal client for Android Free and open source. Bring your own VirusTotal API key to scan files, links, and installed applications against over 70 engines, built with a Material 3 interface. No accounts, no tracking, no ads. What is Veto? Veto is an Android client for...

UBUNTU-CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CLSA-2026-1788776288 TuxCare security update for com.rabbitmq:amqp-client (2 CVEs)

TuxCare rebuilt com.rabbitmq:amqp-client to address 2 CVEs. Fixed in 5.19.0-tuxcare.1...

Security update for nghttp2

This update for nghttp2 fixes the following issue: CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning bsc1269489. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate...

SUSE-SU-2026:4029-1 Security update for nghttp2

This update for nghttp2 fixes the following issue: - CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning bsc1269489...

Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163. Patch Instructions: To install this SUSE update use...

SUSE-SU-2026:4028-1 Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163...

ROOT-APP-GOBINARY-CVE-2026-73500 CVE-2026-73500 in go.etcd.io/etcd/client/pkg/v3 - Patched by Root

Root has patched CVE-2026-73500 in the go.etcd.io/etcd/client/pkg/v3 package for Root:Go. Multiple fixed versions available...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Proton-J, MongoDB Client, Apache HTTP Client and Netty Vulnerability Details CVEID:CVE-2026-59903 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final,...

BIT-NODE-MIN-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

BIT-NODE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-86805

Name of the Vulnerable Software and Affected Versions 389 Directory Server affected versions not specified Description The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value. This allows an unauthenticated client to...

PT-2026-95033

TuxCare rebuilt com.rabbitmq:amqp-client to address 2 CVEs. Fixed in 5.19.0-tuxcare.1...

PT-2026-86928

Improper Authentication vulnerability in ash-project ash authentication oauth2 server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve secret/3 in AshAuthentication.Oauth2Server reached through resolve...

CVE-2026-82753: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...