MAL-2026-13998 Malicious code in async-critical-section (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 933cc6900114e5aef5a4b89e0c20c0242cf368b5322cf260ae395c75cc97552f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

CVE-2026-73626

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

EUVD-2026-57795

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit a heap use-after-free vulnerability when a client connects with asynchronous updates enabled. By sending a specially crafted Window Alternate Secondary Order message, the server can trigger memo...

Linux Distros Unpatched Vulnerability : CVE-2026-71290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used...

CVE-2026-49467

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password TOTP settings. The root cause is a missing await keyword on calls to the asynchrono...

SUSE CVE-2026-68381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2oplockbreaknoti and smb2leasebreaknoti store a ksmbdconn pointer in an async ksmbdwork and then queue that work on ksmbd-io. The work only increments conn-rcount, which...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in jackson-core jar (CVE-2026-18401, CVE-2026-68494)

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-18401 and CVE-2026-68494 reported for jackson-core-2.17.1.jar Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION: The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength...

SUSE CVE-2026-68426

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...

Improper Certificate Validation

Overview org.apache.httpcomponents.client5:httpclient5 is a HttpClient component of the Apache HttpComponents project. Affected versions of this package are vulnerable to Improper Certificate Validation due to the HostnameVerificationPolicyBUILTIN setting having no effect in the async transport. ...

DEBIAN-CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

UBUNTU-CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Apache HttpComponents Client 5.4 and newer contains an improper TLS hostname verification vulnerability (CWE-295) in the async version of HttpClient. The root cause is that the HostnameVerificationPolicy#BUILTIN setting has no effect, allowing a network attacker to intercept traffic and impersona...

EUVD-2026-56973

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...