PT-2026-80169

Name of the Vulnerable Software and Affected Versions Icinga 2 versions 2.8 through 2.14.8 Icinga 2 versions 2.15.0 through 2.15.3 Icinga 2 versions 2.16.0 through 2.16.1 Description Certificate update JSON-RPC message handling fails to validate whether the sender is a trusted endpoint. An...

CVE-2026-18618: Allocation of Resources Without Limits or Throttling

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

PT-2026-69958

Name of the Vulnerable Software and Affected Versions ml-metadata affected versions not specified Description An outdated statically-linked gRPC stack in ml-metadata is susceptible to HTTP/2 denial of service DoS issues. An attacker with network access to the MLMD pod can send specially crafted...

PT-2026-76463

Impact h2 =4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive CWE-444...

Photon OS 5.0: Apache PHSA-2026-5.0-91-0798

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0798. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Nghttp2 PHSA-2026-5.0-92-0802

An update of the nghttp2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0802. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Go PHSA-2026-5.0-91-0869

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0869. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69309

Name of the Vulnerable Software and Affected Versions ash-project ash versions 1.52.0-rc.11 through 3.31.0 Description Improper Neutralization of Special Elements in Data Query Logic allows an attacker to forge a relationship to a record they cannot name and recover the secret value used for...

PT-2026-69308

Name of the Vulnerable Software and Affected Versions ash-project ash versions 1.17.0 through 3.31.0 Description An uncontrolled resource consumption issue exists where an attacker can exhaust node memory using a crafted keyset pagination cursor. Read actions utilizing keyset pagination deseriali...

CVE-2026-69659: Deserialization of Untrusted Data

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

MaxBodyLength Limit Bypass

axios is vulnerable to a maxBodyLength limit bypass. The vulnerability is due to the HTTP/2 request API not enforcing the configured maxBodyLength limit and axios's byte-counting stream wrapper being conditionally applied, which allows an attacker who controls a streamed request body to transmit...

DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Bamboo Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows a...

PT-2026-69037

Name of the Vulnerable Software and Affected Versions postgrex versions 0.19.3 through 0.22.3 Description An SQL Injection issue exists in the postgrex library used by elixir-ecto. The flaw occurs when the :comment option is used within the Postgrex.stream/4 function or the Ecto.Repo.stream/2...

CVE-2026-66838: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

PT-2026-69055

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 affected versions not specified Nexus Repository 2 affected versions not specified Description An account with the nexus:settings:update permission in Nexus Repository 3, or the nexus:settings permission in Nexus Repository ...

CVE-2026-71324

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

HTTP Request Smuggling

Overview h2 is a Pure-Python HTTP/2 protocol implementation Affected versions of this package are vulnerable to HTTP Request Smuggling via the processing of HTTP/2 request headers containing multiple Host headers. An attacker can interfere with downstream HTTP/1.1 applications by crafting request...

DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVS...

DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.12.1, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS...