29571 matches found
CVE-2026-15713: Missing Release of Resource after Effective Lifetime
A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...
CVE-2026-15713: Missing Release of Resource after Effective Lifetime
A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated...
CVE-2026-15712: Out-of-bounds Read
A heap buffer over-read vulnerability was discovered in libsoup's HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser...
CVE-2026-6790: Improper Input Validation
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...
CVE-2026-15712: Out-of-bounds Read
A heap buffer over-read vulnerability was discovered in libsoup's HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser...
CVE-2026-48068: Uncaught Exception
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in...
CVE-2026-49788: Allocation of Resources Without Limits or Throttling
Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network...
fast-whisper-diarizer (>=0.1.2, <=0.1.32), faster-whisper-hotkey (>=0.5.0, <=0.5.5) +8 more potentially affected by CVE-2025-33245 via nemo-toolkit (>=2.0.0rc0, <=2.5.3)
nemo-toolkit PYPI version =2.0.0rc0, =0.1.2, =0.5.0, =1.0.0, =0.0.1, =1.0.3, =1.0.7 Source cves: CVE-2025-33245 Source advisory: OSV:PYSEC-2026-2672...
fast-whisper-diarizer (>=0.1.2, <=0.1.32), faster-whisper-hotkey (>=0.5.0, <=0.5.5) +8 more potentially affected by CVE-2025-33253 via nemo-toolkit (>=2.0.0rc0, <=2.5.3)
nemo-toolkit PYPI version =2.0.0rc0, =0.1.2, =0.5.0, =1.0.0, =0.0.1, =1.0.3, =1.0.7 Source cves: CVE-2025-33253 Source advisory: OSV:PYSEC-2026-2673...
PYSEC-2026-3331 TensorFlow has segfault in array_ops.upper_bound
Impact arrayops.upperbound causes a segfault when not given a rank 2 tensor. Patches We have patched the issue in GitHub commit 915884fdf5df34aaedd00fc6ace33a2cfdefa586. The fix will be included in TensorFlow 2.13. We will also cherrypick this commit in TensorFlow 2.12.1. For more information...
PT-2026-59094
A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is safe regex pattern of the component search code advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the atta...
PT-2026-59665
Impact A Python operator precedence bug in pyzipper/zipfile aes.py caused the AE-2 format to never be automatically selected during encryption, regardless of file size or compression type. As a result, all encrypted entries are written in AE-1 format unless AE-2 is explicitly forced by the caller...
PT-2026-63661
Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details...
RHEL 8 : nginx:1.24 (RHSA-2026:38847)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:38847 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...
RockyLinux 8 : nginx:1.24 (RLSA-2026:38847)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:38847 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes and Enhancements:...
PT-2026-63681
Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details...
[SECURITY] Fedora 44 Update: log4cxx-1.7.0-2.fc44
Log4cxx is a popular logging package written in C++. One of its distinctive features is the notion of inheritance in loggers. Using a logger hierarchy it is possible to control which log statements are output at arbitrary granularity. This helps reduce the volume of logged output and minimize the...
[SECURITY] Fedora 43 Update: upower-1.91.3-2.fc43
UPower formerly DeviceKit-power provides a daemon, API and command line tools for managing power devices attached to the system...
