CVE-2026-26446

Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP connection was already closed by the peer, the server process receives SIGPIPE and immediately terminates, resulting in a denial of service. Any unauthenticated client can trigger the crash by closi...

EUVD-2026-66755

Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP connection was already closed by the peer, the server process receives SIGPIPE and immediately terminates, resulting in a denial of service. Any unauthenticated client can trigger the crash by closi...

CVE-2026-26446

Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP connection was already closed by the peer, the server process receives SIGPIPE and immediately terminates, resulting in a denial of service. Any unauthenticated client can trigger the crash by closi...

EUVD-2026-66753

Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client or a later connection sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: pcp (UTSA-2026-104835)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104835 advisory. A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and...

CVE-2025-61163

The Cohere North AI v1.1.5 software is susceptible to an excessively permissive cross-domain policy because the server fails to properly validate the Origin header of incoming connection requests. This flaw allows untrusted domains to bypass security restrictions, potentially enabling an attacker...

PT-2026-82048

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

@objectstack/cli (>=15.0.0, <=17.0.0), @objectstack/cloud-connection (>=15.1.1, <=17.0.0) +6 more potentially affected by CVE-2026-80192 via @better-auth/sso (>=1.7.0-rc.1, <=1.7.0-rc.2)

@better-auth/sso NPM version =1.7.0-rc.1, =15.0.0, =15.1.1, =15.0.0, =15.1.1, =15.0.0, =15.1.1, =17.0.0-rc.4, =15.1.1, =17.0.0 Source cves: CVE-2026-80192 Source advisory: MEND:CVE-2026-80192...

curl: CVE-2026-80231: native CA store conn reuse

Summary nativecastore is in struct sslconfigdata line 73 of vtlsconfig.h, not sslprimaryconfig. matchsslprimaryconfig does not compare it. On macOS, Curlssleasyconfigcomplete line 258 auto-sets nativecastore = TRUE when no custom CA is configured — without modifying ssloptions. When CURLCABUNDLE ...

CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

curl: CVE-2026-80229: OpenSSL provider use-after-free

Summary When CURLOPTSSLENGINE is set e.g. "default" on OpenSSL 3.x, osslsetprovider line 1791 allocates a per-handle OSSLLIBCTX and stores it in data-state.libctx. During TLS connection setup, SSLCTXnewex line 3750 receives this library context and embeds a pointer to it inside the newly created...

curl: OpenSSL ENGINE selection omitted from mTLS connection matching

Summary When an application sets CURLOPTSSLENGINE to select an OpenSSL ENGINE for resolving ENG-type client certificate and private key identifiers, the engine selection is not included in the TLS configuration compared during connection reuse. A second easy handle with a different engine but the...

USN-8670-2: curl vulnerability

USN-8670-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. Original advisory details: Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. Thi...

USN-8670-2 curl vulnerability

USN-8670-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. Original advisory details: Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. Thi...

SUSE CVE-2026-78701

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of...

CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

Security update for curl

This update for curl fixes the following issues: CVE-2026-5545: wrong reuse of HTTP Negotiate connection bsc1262632. CVE-2026-5773: wrong reuse of SMB connection bsc1262633. CVE-2026-6253: proxy credentials leak over redirect-to proxy bsc1262635. CVE-2026-6276: stale custom cookie host causes...

SUSE-SU-2026:3798-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5545: wrong reuse of HTTP Negotiate connection bsc1262632. - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-6253: proxy credentials leak over redirect-to proxy bsc1262635. - CVE-2026-6276: stale custom cookie host...

CVE-2026-78701

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of...

CVE-2026-78701 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer SASL UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of...