CVE-2026-81868

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

EUVD-2026-81813

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90220 ALSA: seq: Don't leak the extension cell pointer in the bounce payload

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

EUVD-2026-81718

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2newreadreq smb2newreadreq allocates the request buffer with smb2plainreqinit but only publishes it to the caller with buf = req at the very end of the function. Two error returns sit in...

CVE-2026-90125

CVE-2026-90125 is a request buffer leak in the Linux kernel's SMB client , specifically in smb2_new_read_req(). The function allocates a buffer via smb2_plain_req_init() but fails to release it on two early error returns: a failed initialization and a failed smbd_register_mr() call. Because -EAGA...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

EUVD-2026-81899

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868

Steeltoe (open-source cloud-native application libraries) is vulnerable in Steeltoe.Security.Authorization.Certificate prior to version 4.3.0 . When using AddOrgAndSpacePolicies() and UseCertificateAuthorization(), the framework trusts the public certificate supplied in the X-Client-Cert request ...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

tomcat: Client certificate verification bypass due to virtual host mapping

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Vulnerability In AMQConnection.java line 435-436, after Connection.Tune negotiation, the frame-max limit is set via: java frameHandler.setFrameMax Math.minthis.maxInboundMessageBodySize, frameMax; When frameMax = 0 meaning "unlimited" per AMQP spec, Math.min67108864, 0 = 0. This value is then...

EUVD-2026-80941

RabbitMQ Java client has frame-level OOM: Math.minmaxInboundMessageBodySize, 0 defeats frame size enforcement...

GHSA-JH4V-GFQJ-7RHX RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Vulnerability In AMQConnection.java line 435-436, after Connection.Tune negotiation, the frame-max limit is set via: java frameHandler.setFrameMax Math.minthis.maxInboundMessageBodySize, frameMax; When frameMax = 0 meaning "unlimited" per AMQP spec, Math.min67108864, 0 = 0. This value is then...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the inbound frame size handling in AMQConnection.java. An attacker can trigger excessive frame allocation and crash the client by negotiating framemax=0 and then sending an...

fastrepl-client (0.0.1) potentially affected by CVE-2026-59823 via litellm (0.4.4)

litellm PYPI version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl-client 0.0.1 Source cves: CVE-2026-59823 Source advisory: OSV:GHSA-HX8V-G79F-8W5F...

valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free

A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport...

BIT-MONGODB-2026-18703 Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...