CVE-2025-62341

HCL Connections contains a server-side request forgery (SSRF) vulnerability that becomes exploitable when an internal server is compromised. In certain scenarios, an attacker can send unauthorized requests, potentially leading to information disclosure or security bypass . The CVSS 3.1 base score...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

PT-2026-82328

Name of the Vulnerable Software and Affected Versions HCL Connections affected versions not specified Description HCL Connections is susceptible to server-side request forgery SSRF, a flaw that occurs when a server is tricked into making requests to an unintended location. This issue arises when ...

MiracleLinux 8 : java-1.8.0-openjdk-1.8.0.504.b01-1.1.el8 (AXSA:2026-1656:16)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1656:16 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has...

CVE-2025-62341: Server-Side Request Forgery (SSRF)

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

MiracleLinux 8 : java-17-openjdk-17.0.20.1.1-1.1.el8 (AXSA:2026-1669:15)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1669:15 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has...

CVE-2026-63075

OpenSSL's QUIC stack retains ACK-only packet metadata in its packet history for the full lifetime of a connection. Since ACK-only packets are not ack-eliciting, a remote peer that completes a QUIC handshake can force repeated ACK-only packet transmission (e.g., by sending numerous PING frames ) a...

java-1.7.0-openjdk: Fix of 11 CVEs

CVE-2024-20952: Enhance TLS connection support JDK-8317547, JDK-8302017 - CVE-2025-21587: Better TLS connection support JDK-8337692 - CVE-2026-34268: Enhance key generation JDK-8371935 - CVE-2026-22007: Enhance crypto algorithm support JDK-8369575 - CVE-2026-21925: Improve JMX connections...

CVE-2026-78323

A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.52 and earlier fail to close inbound connections when errors occur during the discarding of the request body, exposing the server to HTTP Request Smuggling attacks...

Astra Linux – Vulnerability in Tomcat9

Improper handling of exceptional conditions, and uncontrolled resource consumption vulnerabilities in Apache Tomcat. When processing an HTTP/2 stream, Tomcat failed to correctly handle some cases of excessive HTTP headers. This resulted in an incorrect count of active HTTP/2 streams, leading to t...

Astra Linux – Vulnerability in Ruby 2.5, JRuby

A issue was discovered in Ruby between versions 2.6.7, 2.7.x up to 2.7.3, and 3.x up to 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a specified IP address and port. This potentially allows curl to extract information about services that would...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: cifs: fixed handlecache and multiuser In multiuser mode, each individual user has its own tcon structure for the shared resource, and thus they have their own handle for the cached directory. When unmounting such a shared...

Astra Linux – Vulnerability in Linux 5.15

There is a flaw in the Linux kernel’s handling of new TCP connections. The issue arises due to the lack of memory release after the effective lifetime of these connections. This vulnerability allows an unauthenticated attacker to create a denial-of-service condition on the system...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: It prevents repeated connections from clients with the same IP address. Repeated connections from clients with the same IP address may exhaust the maximum number of connections allowed, thereby preventing other normal clie...

CVE-2026-78205 BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

AlmaLinux 10 : java-25-openjdk (ALSA-2026:55798)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55798 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Improve font loading CVE-2026-70906 JDK: Enhance TLS...

java-25-openjdk security update

An update is available for java-25-openjdk. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime...

RLSA-2026:55798 Moderate: java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fixes: JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Improve font loading CVE-2026-70906 JDK: Enhance TLS server...

java-1.8.0-openjdk security update

An update is available for java-1.8.0-openjdk. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime...