SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3207-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3207-1 advisory. This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient restrictions in...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service bsc1261320. CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service...

SUSE-SU-2026:3207-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service bsc1261320. - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of...

EUVD-2026-48242

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

CVE-2026-65606 SiYuan before v3.7.2 Cross-Site Scripting to RCE

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

GHSA-GCJF-9MGH-3P7G Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-http multipart | | Component |...

GHSA-3G8R-4PFX-JMFH Netty: STOMP CONNECT Frame Header Injection in Netty

Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-stomp | | Component | io.netty.handler.codec.stomp.StompSubframeEncoder | |...

Netty: STOMP CONNECT Frame Header Injection in Netty

Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-stomp | | Component | io.netty.handler.codec.stomp.StompSubframeEncoder | |...

USN-8591-1: AIOHTTP vulnerabilities

Sean Gilligan discovered that AIOHTTP did not properly limit memory usage when processing HTTP headers and trailers. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. CVE-2026-22815 It was discovered that AIOHTTP did not properly...

GHSA-6MXQ-JR92-3H2R Duplicate Advisory: Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qq9q-x9w4-chhj. This link is maintained to preserve external references. Original Description Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API...

CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

Plone < 4.2.3 Multiple Vulnerabilities (HF 20121106)

The version of Plone installed on the remote host is prior to 4.2.3. It is, therefore, affected by the following vulnerabilities: - registerConfiglet.py in Plone allows remote attackers to execute Python code via unspecified vectors, related to the admin interface. CVE-2012-5485 -...

PT-2026-63551

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description Netty's STOMP encoder StompSubframeEncoder fails to escape or validate header values in CONNECT and CONNECTED frames. This occurs because the encoder...

Plone 3.3.x < 4.3.7 Multiple Vulnerabilities (HF 20150910)

The version of Plone installed on the remote host is 3.3.x prior to 4.3.7. It is, therefore, affected by the following vulnerabilities: - Plone allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator CVE-2015-7315 -...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data...

USN-8571-1: Apache HTTP Server vulnerabilities

Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server incorrectly handled certain memory operations in modauthnsocache. A remote attacker could possibly use this issue to cause a denial of service. CVE-2026-33007 Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apach...

GHSA-PR2V-JX2C-WG9F Tornado vulnerable to Header Injection and XSS via reason argument

Header injection and XSS via reason argument Summary The reason argument used by both RequestHandler.setstatus and tornado.web.HTTPError is designed to allow applications to pass custom "reason" phrases the "Not Found" in HTTP/1.1 404 Not Found to the HTTP status line mainly for non-standard stat...

EUVD-2025-203032

Tornado vulnerable to Header Injection and XSS via reason argument...

Tornado vulnerable to Header Injection and XSS via reason argument

Header injection and XSS via reason argument Summary The reason argument used by both RequestHandler.setstatus and tornado.web.HTTPError is designed to allow applications to pass custom "reason" phrases the "Not Found" in HTTP/1.1 404 Not Found to the HTTP status line mainly for non-standard stat...