CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-82561 Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

CVE-2026-82561 Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

EUVD-2026-81077

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

CVE-2026-82561 Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

CVE-2026-82561

Apache NiFi versions 1.5.0 through 2.11.0 contain a missing authorization flaw in REST API methods used for Process Group flow replacement and versioned flow update/rebase operations. These methods only checked read/write permissions on the Process Group itself, unlike their asynchronous counterp...

EUVD-2026-81076

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

CVE-2026-86089 Apache NiFi: Missing Process Group Authorization for Connector Migration

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

CVE-2026-86089 Apache NiFi: Missing Process Group Authorization for Connector Migration

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

CVE-2026-86089

Apache NiFi 2.11.0 introduced REST API methods to migrate version-controlled Process Groups into a Connector . The authorization check was performed only against the target Connector, not against the source Process Group, allowing an authenticated user with read access to a Connector to enumerate...

CVE-2026-81875 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...

CVE-2026-75516

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start applies Math.minmaxInboundMessageBodySize, frameMax after Connection.Tune negotiation even though AMQP defines frameMax value zero as...

CVE-2026-92626

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference exception. The exception is thrown from an...

Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to improper buffer...

SUSE CVE-2026-91708

Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91712

Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91713

Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-91724

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91727

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

SUSE CVE-2026-91730

Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...