USN-8822-1: Libwebsockets vulnerabilities

It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A remote attacker could possibly use this issue to cause Libwebsockets to consume excessive resources, resulting in a denial of service. CVE-2026-10650 It was discovered that...

PT-2026-98920

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.17 RabbitMQ versions 4.0.x prior to 4.0.23 RabbitMQ versions 4.1.x prior to 4.1.14 RabbitMQ versions 4.2.x prior to 4.2.9 RabbitMQ versions 4.3.x prior to 4.3.3 Description Native MQTT and MQTT over...

CVE-2025-1218: Heap-based Buffer Overflow

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and c...

Linux Distros Unpatched Vulnerability : CVE-2026-67225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated...

PT-2026-98927

Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop enqueue request in kitty/dnd....

CVE-2026-67411: Incorrect Authorization

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopbackusers, causing th...

CVE-2026-95834: Use After Free

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because dragremotefiledata in kitty/dnd.c holds a DragRemoteItem pointer into an arra...

CVE-2026-67225: Allocation of Resources Without Limits or Throttling

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

CVE-2026-80430: Improper Link Resolution Before File Access

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

PT-2026-98839

Name of the Vulnerable Software and Affected Versions kitty versions 0.47.0 through 0.48.x Description Improper link resolution in the drag source staging path of the drag and drop protocol allows a program writing to the terminal to create files and directories outside the staging directory. Thi...

PT-2026-98850

Name of the Vulnerable Software and Affected Versions kitty versions 0.40.0 through 0.48.x Description An out-of-bounds write exists in the natural width branch of the text sizing protocol. The screen handle multicell command function in kitty/screen.c appends each codepoint of a grapheme cluster...

ROS-20260925-73-0093

The vulnerability of the p9clientwalk function in the net/9p/client.c module of the 9P protocol implementation in the Linux operating system is related to the dereferencing of a pointer whose validity period has expired. Exploiting this vulnerability allows an attacker to compromise the...

PT-2026-98906

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description When the stream plugin is enabled, the stream protocol stores the...

PT-2026-98364

Name of the Vulnerable Software and Affected Versions AMP for WP versions prior to 1.1.17 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment content. The issue occurs during Regex Transformation,...

A Three-Party W-State Quantum Secret Sharing Protocol with X-Gate Encoding and Forbidden-Outcome Detection

We develop a new three-party quantum secret-sharing QSS protocol based on a three-qubit W state. This protocol encodes the secret-sequence bits using X gates and employs randomly selected Hadamard operations and measurement bases to generate information and security-test rounds. We evaluate the...

ROS-20260925-73-0029

The vulnerability of the sctpwaitforconnect function in the net/sctp/socket.c module of the Linux operating system’s SCTP protocol implementation is related to the lack of measures taken to neutralize numerous internal special elements. Exploiting this vulnerability can allow an attacker to...

The vulnerability of the GoBGP border gateway protocol, related to the handling of the zero pointer, allows a attacker to cause a service failure.

The vulnerability of the GoBGP edge gateway protocol is related to the handling of the zero pointer. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

PT-2026-98931

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag remote file data in kitty/dnd.c holds a DragRemoteItem pointer into an...

Linux Distros Unpatched Vulnerability : CVE-2026-92164

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file...

Linux Distros Unpatched Vulnerability : CVE-2026-98050

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather...