CVE-2026-99245

A flaw was found in the Linux kernel. A local user could bypass keyring link restrictions due to a race condition in the kernel's key management subsystem. This issue occurs when the kernel checks link restrictions before acquiring the necessary lock during key linking operations, racing against...

HTTP Request Smuggling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/2 request...

HTTP Request Smuggling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/2 request...

USN-8890-1 libsoup2.4, libsoup3 vulnerabilities

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-4271 It was discovered that libsoup incorrectly handled certain HTTPS...

AlmaLinux 9.2 [TuxCare] Security Update: keylime / keylime-base / keylime-registrar / keylime-selinux / etc (ALMALINUX9.2:CLSA-2025:1766502382)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1766502382 advisory. - A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted...

PT-2026-97112

Name of the Vulnerable Software and Affected Versions OpenEye Apex Network Video Recorder versions 2.2.3.4 through 3.2.9.376 Description The software trusts an X-Forwarded-For header provided by a client to determine the request source address. This allows an unauthenticated remote attacker to...

CVE-2026-93573

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass "Transfer-Encoding" header validation by splitting the "Transfer-Encoding" field across multiple headers, with the last field containing a non-final transfer coding like "gzip" or "deflate". This...

PT-2026-95422

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description An issue exists in the HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request contains both an absolute-form request-target and a conflicting Host header, the system incorrectly prioritize...

PT-2026-95423

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the HTTP/1.1 decoder allows a remote attacker to bypass Transfer-Encoding header validation. By splitting the Transfer-Encoding field across multiple headers and ensuring the last fie...

Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix

A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue CVE-2025-66614. This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application...

HTTP Header Injection

Blaze is vulnerable to HTTP header injection. The vulnerability is due to blaze-server merging attacker-controlled HTTP trailer fields into Request.headers, which allows an unauthenticated remote attacker to inject or spoof trusted headers such as X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or...

CVE-2026-78319 TOCTOU Vulnerability in file exchange

A service running on the affected products contains a potential Time-of-Check Time-of-Use TOCTOU race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execution of unauthorized code...

Undertow input validation error vulnerability

Undertow has a vulnerability related to input validation. This vulnerability stems from the parser in the ChunkReader component, which uses a single internal variable to store the remaining block size and status flags. Attackers can exploit this by sending specially crafted requests with an...

PT-2026-68570

Name of the Vulnerable Software and Affected Versions Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder versions prior to 1.9.1 Description Broken authentication allows unauthenticated users to bypass security controls within the plugin. Recommendation...

CVE-2026-8646

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security...

CVE-2026-8646: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

CVE-2026-45588

CVE-2026-45588 concerns a protection mechanism failure in Windows Secure Boot that allows an authorized attacker to bypass a security feature locally. The NVD/CVE entry describes a local attack with high impact on confidentiality and integrity and no availability impact, requiring high privileges...

[SECURITY] [DSA 6317-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6317-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 01, 2026 https://www.debian.org/security/faq -...