PT-2026-71895

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. During this process,...

CVE-2026-56853: Allocation of Resources Without Limits or Throttling

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 For more details about the security issues,...

CVE-2026-56755: Improper Access Control

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

PT-2026-80514

gf2n.cpp in Crypto++ aka cryptopp through 8.9.0 allows attackers to cause a denial of service application crash via DER public-key data for an F2^m curve, if the degree of each term in the polynomial is not strictly decreasing...

RHEL 9 : nghttp2 (RHSA-2026:54662)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54662 advisory. libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP...

TencentOS Server 2: python3 (TSSA-2026:0847)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0847 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21545-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21545-1 advisory. Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-...

openSUSE 16 Security Update : nodejs24 (openSUSE-SU-2026:21546-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21546-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-...

GLSA-202608-05 : Apache HTTPD: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-05 Apache HTTPD: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...

CVE-2026-17431 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...

CVE-2026-17431

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...

CVE-2026-17431

PDF::WebKit versions through 1.2 for Perl are vulnerable to OS command injection due to the use of Perl's 2-arg open() function. The vulnerability exists in the to_pdf , _style_tag_for , and to_file functions, which handle output paths and stylesheet entries. Specifically, providing input that be...

io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...

CVE-2018-16844

creationtimestamp| type| source ---|---|--- 2026-08-12 17:00:04+00:00| published-proof-of-concept| Telegram/JXwhaG7Kk3-6UOVRR1APiaO6CTcjXaQDI8i4is7Q1Jd9s 2026-08-12 17:00:04+00:00| seen| Telegram/C6vVyMDURhpvZI0H3EkJps5fsiSVlluQ8gZPOZtlvYIjgA 2026-08-13 00:00:07+00:00| published-proof-of-concept|...

Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities

Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These vulnerabilities have been addressed in IBM Planning Analytics Local v2.0 - IBM Planning Analytics Workspace version 2.1.23. Vulnerability Details CVEID:CVE-2026-47244...

Security Bulletin: linkify-it-5.0.1.tgz security vulnerability in Content Cortex(CCx) reported for GenAI ICN Plugin

Summary linkify-it-5.0.1.tgz CVE-2026-59887 security vulnerability in Content CortexCCx reported for GenAI ICN Plugin Vulnerability Details CVEID:CVE-2026-59887 DESCRIPTION: linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by...

Denial-of-service (DoS)

Apache HttpComponents Core is vulnerable to a denial-of-service DoS vulnerability. The vulnerability is due to the decoder processing oversized compressed HTTP/2 header blocks without applying the configured header list size limit until the SETTINGS acknowledgement, which allows a remote attacker...

CLSA-2026-1786536790 TuxCare security update for org.apache.httpcomponents (2 CVEs)

TuxCare rebuilt 6 org.apache.httpcomponents packages to address 2 CVEs. Fixed in 4.2-tuxcare.2...

Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance

Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-50560 Vulnerability Details CVEID:CVE-2026-50560 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions...