CVE-2026-87022 Apache Tomcat: WebSocket message smuggling with per-message-deflate

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-77791 Apache Tomcat: DoS via busy wait during WebSocket close

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

EUVD-2026-85229

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

CVE-2026-77791

Apache Tomcat is vulnerable to a Denial of Service (DoS) attack due to an uncontrolled resource consumption issue occurring during the sending of a WebSocket close message . The root cause is a busy wait condition that can be triggered by an attacker. This vulnerability affects versions 11.0.0-M5...

CVE-2026-94057

A flaw was found in Exim. A remote attacker could exploit a vulnerability known as SMTP smuggling by sending crafted data after a rejection during the DATA processing phase. This manipulation could lead to a mismatch between the intended sent message and the actual received message, potentially...

pgbouncer: PgBouncer: Denial of Service via malformed SCRAM client-final-message

A flaw was found in PgBouncer. Missing validation of a mandatory attribute in the SCRAM client-final-message parser allows an unauthenticated remote attacker to crash the process. By sending a malformed message, the parser can report success while a required value remains unset, leading to a NULL...

Malicious code in sea-baileys (npm)

Source: amazon-inspector 2aaf4b5ddb859270a86aa6d21df680ed66fb0622434317747a6f7275ad9a3d60 sea-baileys is a fork of the Baileys WhatsApp Web library. Its package.json remaps the libsignal import specifier to npm:@otaxayun/libsignal-node@latest — an unrelated maintainer's package pinned to the...

CVE-2026-63449

A flaw was found in Suricata, a network Intrusion Detection System IDS and Intrusion Prevention System IPS. The Session Initiation Protocol SIP parser incorrectly handles large SIP message bodies. When a SIP message body exceeds 65,536 bytes, the parser truncates its length, preventing the full...

CVE-2026-61548

A flaw was found in Rsyslog, a system for log processing. A remote unauthenticated attacker could exploit a stack buffer overflow vulnerability within the optional mmpstrucdata plugin. By sending a specially crafted RFC5424 message containing an oversized structured-data parameter, the attacker c...

corosync security update

An update is available for corosync. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The corosync packages provide the Corosync Cluster Engine and C APIs for Roc...

RLSA-2026:69277 Important: corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software. Security Fixes: corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly CVE-2026-81665 For more details about the security issues, includin...

CVE-2026-12803

A flaw was found in Bouncy Castle for Java. The cryptographic module responsible for authenticated encryption does not correctly link a unique random value nonce with the message authentication code when no additional authenticated data is provided. This oversight could allow an attacker to forge...

PT-2026-97398

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description In the H2PersistentQueue component, session message-map names are derived using the prefix queue followed by the client ID, while metadata-map names use queue , the client ID, and the suffix meta. ...

CVE-2026-95846: Missing Authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-87022: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

MiracleLinux 8 : corosync-3.1.8-1.el8_10.2 (AXSA:2026-1890:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1890:06 advisory. corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly CVE-2026-81665 Tenable has extracted the...

PT-2026-97388

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.3 Description An issue exists in the SCRAM Salted Challenge Response Authentication Mechanism client-final-message parser. The parser fails to validate a mandatory attribute, which can lead to a NULL pointer...

PT-2026-104838

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

PT-2026-97185

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to bind saved-draft notifications to the visitor who created the draft. It accepts both the recipient address and the link included in the message direct...

CVE-2026-19888: NULL Pointer Dereference

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...