Veto v2.3

Veto An open source VirusTotal client for Android Free and open source. Bring your own VirusTotal API key to scan files, links, and installed applications against over 70 engines, built with a Material 3 interface. No accounts, no tracking, no ads. What is Veto? Veto is an Android client for...

UBUNTU-CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CLSA-2026-1788776288 TuxCare security update for com.rabbitmq:amqp-client (2 CVEs)

TuxCare rebuilt com.rabbitmq:amqp-client to address 2 CVEs. Fixed in 5.19.0-tuxcare.1...

Security update for nghttp2

This update for nghttp2 fixes the following issue: CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning bsc1269489. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate...

SUSE-SU-2026:4029-1 Security update for nghttp2

This update for nghttp2 fixes the following issue: - CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning bsc1269489...

Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163. Patch Instructions: To install this SUSE update use...

SUSE-SU-2026:4028-1 Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163...

ROOT-APP-GOBINARY-CVE-2026-73500 CVE-2026-73500 in go.etcd.io/etcd/client/pkg/v3 - Patched by Root

Root has patched CVE-2026-73500 in the go.etcd.io/etcd/client/pkg/v3 package for Root:Go. Multiple fixed versions available...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Proton-J, MongoDB Client, Apache HTTP Client and Netty Vulnerability Details CVEID:CVE-2026-59903 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final,...

BIT-NODE-MIN-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

BIT-NODE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-86740

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-95033

TuxCare rebuilt com.rabbitmq:amqp-client to address 2 CVEs. Fixed in 5.19.0-tuxcare.1...

CVE-2026-82753: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...

PT-2026-86928

Improper Authentication vulnerability in ash-project ash authentication oauth2 server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve secret/3 in AshAuthentication.Oauth2Server reached through resolve...

Linux Distros Unpatched Vulnerability : CVE-2026-76578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the...

MiracleLinux 8 : kernel-4.18.0-553.157.1.el8_10 (AXSA:2026-1779:74)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1779:74 advisory. kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in ip6erspanchangeli...

CVE-2026-82758: Improper Authentication

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

PT-2026-86741

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-86805

Name of the Vulnerable Software and Affected Versions 389 Directory Server affected versions not specified Description The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value. This allows an unauthenticated client to...