CVE-2026-58155 Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

CVE-2026-58155 Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

CVE-2026-58155 Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

CVE-2026-22068 Apache Traffic Server: Regex mappings match with malicious domain names

Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue...

CVE-2026-41920

CVE-2026-41920 concerns an Improper Access Control in Apache Traffic Server. Affected versions are 9.0.0–9.1.14 and 10.0.0–10.1.3. The issue is fixed in 9.1.15 and 10.1.4. The provided sources do not include explicit root cause details beyond the access-control context, nor estimates of exploitat...

CVE-2026-63236 Improper access control vulnerability

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint...

SUSE-SU-2026:22977-1 Security update for samba

This update for samba fixes the following issues: - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-by...

[slackware-security] samba

New samba packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/samba-4.22.11-i586-1slack15.0.txz: Upgraded. This is a security release in order to address the following defects: TSIG packet with name compressi...

OSV-2026-1092 Security exception in com.github.javaparser.ast.expr.Name.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=539142495 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.Name.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.lambda$visit$133 java.base/java.util.Optional.ifPresent...

CVE-2025-67404

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in savestud.php via the parameters fname, lname, and studentclass...

CVE-2025-67407

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatestudent.php via parameters fname and studentclass...

gstreamer1-plugins-bad-free security update

1.22.12-7.3 - Fix incorrect bytes-per-pixel handling in rfbsrc plugin CVE-2026-59691 Resolves: RHEL-193557 1.22.12-7.2 - Fix buffer overflow in DTLS connection peer certificate subject DN handling CVE-2026-59692 Resolves: RHEL-193572...

CVE-2025-67403

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updateclass.php via the parameter classname...

PT-2026-65748

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

PT-2026-65750

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...

PT-2026-65749

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

PT-2026-65741

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the client policy enforcement mechanism where the system verifies group membership using names rather than unique identifiers. An attacker possessing client management...

PT-2026-65772

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...

SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3362-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3362-1 advisory. This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS...

PT-2026-65707

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint...