[SECURITY] Fedora 45 Update: gssntlmssp-1.3.2-2.fc45

A GSSAPI Mechanism that implements NTLMSSP...

UBUNTU-CVE-2026-104733

User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism...

CVE-2026-104420

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

CVE-2026-104420

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

CVE-2026-104420 Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

EUVD-2026-91431

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

CVE-2026-104420

The Zebra software (versions before 6.3.0 ) contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring. The vulnerability occurs during an inbound cleanup step where the system wrongly downcasts RouterError to VerifyBlockError , causing the associated s...

CVE-2026-104420 Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

CVE-2026-104420: Incorrect Type Conversion or Cast

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

PT-2026-104231

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 6.3.0 Description A protection mechanism failure allows unauthenticated peers to evade misbehavior scoring by providing invalid gossiped blocks. This occurs because the inbound cleanup step incorrectly downcasts...

ROS-20261002-73-0001

The vulnerability of the logical decoding mechanism in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20261002-73-0004

The vulnerability of the logical decoding mechanism in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-104319

User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism...

PyJWT HMAC Algorithm Bypass

The vulnerability of the HMACAlgorithm.preparekey function in the jwt/algorithms.py library of PyJWT is related to errors in cryptographic signature verification. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...

BIT-RABBITMQ-2026-67234 RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

PT-2026-105182

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get auth mechanism/1 used term to binary/1 on the strict auth mechanism or preferred auth mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent...

dispatchRequest() function in the Security Bypass

The vulnerability of the dispatchRequest function in the axios library is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability can allow a remote attacker to bypass existing security mechanisms...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2025:1761084810)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1761084810 advisory. - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation...

Rocky Linux 9 [CIQ] Security Update: xdg-utils (crlsa-2025_7672)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20257672 advisory. xdg-utils: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments CVE-2022-4055 Tenable has extracted the preceding descripti...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1770216227)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770216227 advisory. - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operatio...