CVE-2026-42537

Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fixed a use-after-free in iscsitdecconnusagecount. In iscsitdecconnusagecount, the function calls complete while holding the conn-connusagelock. As soon as complete is invoked, the waiter such as...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: A missing check for the encryption key size was fixed in the L2CAPLEConnREQ. This addition ensures that the key size is checked upon receiving the L2CAPLEConnREQ, which is required by L2CAP/LE/CFC/BV-15-C. This...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: Fixed the issue where the “ct” field was leaked during error paths. There are some situations where “ct” might be leaked because error paths skip the refcounted check and return immediately. To address thi...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: The cleanup limit for connections has been increased to 64. After the optimization to perform only one garbage collection per jiffy, a new problem emerged. If more than 8 new connections are tracked per...

PT-2026-69999

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.5.0 and later Description An out-of-bounds write exists in the tls opt dtls peer connection id value get function within subsys/net/lib/sockets/sockets tls.c. This function handles the getsockoptSOL TLS, TLS DTLS PEER CID VAL...

CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

DEBIAN-CVE-2026-15972

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

UBUNTU-CVE-2026-15972

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

CVE-2026-15972

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

CVE-2026-71849

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

NPM: Hono: Proxy Helper does not remove response headers listed in the `Connection` header

NPM: Hono: Proxy Helper does not remove response headers listed in the Connection header vulnerability discovered by ? in WordPress Npm hono versions = 4.7.0, 4.12.34...

GHSA-79QM-7RJ5-M7R9 Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Summary The Proxy Helper hono/proxy does not remove response headers named by the origin's Connection header. Headers that the origin marked as connection-scoped are therefore forwarded to clients. Details Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a...

Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Summary The Proxy Helper hono/proxy does not remove response headers named by the origin's Connection header. Headers that the origin marked as connection-scoped are therefore forwarded to clients. Details Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a...

CVE-2026-71849 Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

EUVD-2026-54579

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

CVE-2026-71849

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

CVE-2026-71849

Hono (Web application framework) vulnerability: from versions 4.7.0–4.12.33, the Proxy Helper proxy() in hono/proxy does not remove response headers named by the origin’s Connection header, potentially exposing headers intended for the origin’s peer. Per RFC 9110, intermediaries must remove Conne...

CVE-2026-71849 Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...

CVE-2026-71849 Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...