NewStart CGSL MAIN 7.02 : bind Multiple Vulnerabilities (NS-SA-2026-0110)

The remote NewStart CGSL host, running version MAIN 7.02, has bind packages installed that are affected by multiple vulnerabilities: - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions...

EUVD-2026-72537

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

OESA-2026-3660 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn...

OESA-2026-3659 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn fail...

OESA-2026-3658 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn fail...

Origin Validation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Origin Validation Error leading to cache poisoning in the interceptors.cache and interceptors.deduplicate interceptors, which build cache and deduplication keys without t...

Security Bulletin: Vulnerability in Netty's DnsResolveContext affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty's DnsResolveContext has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional...

CVE-2026-85152

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...

DEBIAN-CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152

undici (the Node.js HTTP client) versions 8.10.0 through 8.10.2 are vulnerable to cross-origin cache poisoning when the cache or deduplicate interceptor is composed directly onto a Client or Pool. The root cause is that the internal cache key falls back to an empty origin string, so a cacheable o...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...

Cache Poisoning

Spring AI is vulnerable to cache poisoning. The vulnerability is due to insecure handling of the deterministic cache path, where an attacker can pre‑create the cache directory and plant a malicious ONNX model file and achieve execution when the model is loaded...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106160)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106160 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges...

CVE-2026-85152: Origin Validation Error

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

Linux Distros Unpatched Vulnerability : CVE-2026-85152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a...