Signal-iOS v8.29.0.1866

Signal iOS Signal is a free and open source messaging app for simple private communication with friends. Also available on Android and Desktop. Questions? For troubleshooting and questions, please visit our support center or unofficial community forum. Contributing Bug Reports The best way to...

EulerOS Virtualization 2.11.1 : polkit (EulerOS-SA-2026-3452)

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be...

CVE-2026-16515: Insufficient Control of Network Message Volume (Network Amplification)

neticmpv6senderror in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules do not answer an ICMPv6 error with an ICMPv6 error. It did not check whether the triggering packet's source address identifies a single node rule e.6 or whether the packet was sen...

CVE-2026-10832: Allocation of Resources Without Limits or Throttling

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

CVE-2026-93569: Inconsistent Interpretation of HTTP Requests

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2026-3756)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a hea...

EulerOS Virtualization 2.11.0 : polkit (EulerOS-SA-2026-3539)

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be...

PT-2026-95422

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description An issue exists in the HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request contains both an absolute-form request-target and a conflicting Host header, the system incorrectly prioritize...

EulerOS 2.0 SP10 : shim (EulerOS-SA-2026-3770)

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2026-3709)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a hea...

CVE-2026-63452: Uncontrolled Resource Consumption

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With...

EulerOS Virtualization 2.11.1 : util-linux (EulerOS-SA-2026-3479)

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifical...

CVE-2026-93562: Undefined Security Weakness

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

PT-2026-95697

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the HTTP/1 decoder allows remote attackers to perform HTTP request smuggling due to incomplete validation of malformed Transfer-Encoding headers. By sending specially crafted HTTP...

Security Bulletin: IBM MQ for HPE NonStop is affected by vulnerabilities in OpenSSL

Summary IBM MQ for HPE NonStop is affected by OpenSSL vulnerabilities CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-7383,...

CLSA-2026-1789669098 TuxCare security update for org.springframework.data (4 CVEs)

TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.7.16-tuxcare.1...

AZL-102812 CVE-2026-92510 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroysrquser When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-78223

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

PT-2026-94297

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.8.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description An inefficient algorithmic complexity issue allows an unauthenticated attacker to cause CPU and memory exhaustion by...

CVE-2026-80218: Improper Authentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...