PT-2026-93802

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A flaw in the readField function allows a malicious or compromised AMQP broker to trigger an unhandled runtime panic, leading to a Denial of Service DoS by crashing the client process. T...

Linux Distros Unpatched Vulnerability : CVE-2026-92238

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in...

Linux Distros Unpatched Vulnerability : CVE-2026-19773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...

CVE-2026-92248

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

CVE-2026-92248

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

CVE-2026-92248 Gimp: integer overflow when generating a thumbnail preview for a psd file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

CVE-2026-61559

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

@zereight/mcp-gitlab exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled Host and Origin. The server accepts those...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in form-data-3.0.4.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in form-data-3.0.4.tgz Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend and the filenam...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously captured Authorization header. Workaround Users that are not able to upgrade to...

Replay Attack

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously...

DEBIAN-CVE-2026-92238

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-92238

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-92238

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

UBUNTU-CVE-2026-92238

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

Summary Ember's HTTP/1.1 header parser matches the Transfer-Encoding header value with a case-sensitive substring test hValue.contains"chunked". RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying Transfer-Encoding: Chunked capital C is therefore not...

GHSA-8H4C-X2WG-6XP8 Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 §6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC's CL-strip-and-forward pat...

Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty

Summary Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new dashboardhost setting is empty. In that configuration, /api/v1/oauth2/provider again reflects the request Host header into the OAuth2 redirecturi sent to the identity provider, even if...

GHSA-RF68-8GJR-36Q7 Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty

Summary Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new dashboardhost setting is empty. In that configuration, /api/v1/oauth2/provider again reflects the request Host header into the OAuth2 redirecturi sent to the identity provider, even if...