CVE-2026-93085: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

PT-2026-94799

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware component where the scmi protocol table register function fails to properly roll back registrations. When a later entry in an ID table fails,...

PT-2026-94814

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the arm scmi firmware component. The function scmi protocol device unrequest releases the scmi requested devices mtx mutex while notifying listeners but...

PT-2026-94878

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware component where scmi device destroy uses a protocol and name lookup method that excludes transport devices, preventing them from being properly...

PT-2026-94883

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm scmi firmware component where the system fails to properly reject out-of-range Device Tree DT protocol IDs. While the DT parsing paths identify protocol IDs th...

CVE-2026-92811

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

CVE-2026-92811 browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

CVE-2026-92811 browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

CVE-2026-92811

browserless versions 1.44.0 through 2.56.7 contain a file protocol restriction bypass in its Playwright websocket endpoints. Despite the ALLOW_FILE_PROTOCOL setting defaulting to false, authenticated token holders can navigate Playwright-driven browsers to file:// scheme URLs, enabling arbitrary ...

CVE-2026-92811 browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

DEBIAN-CVE-2026-46352

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protoc...

CVE-2026-63126 Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or...

CVE-2026-63127

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. The OAuth implementation in rmcp omits the RFC 9728 resource field from ResourceServerMetadata. This allows a malicious Model Context Protocol MCP server to publish metadata for a different legitimate MCP resource. Consequently,...

CVE-2026-77411 RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the...

CVE-2026-77411 RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the...

CVE-2026-77411

RabbitMQ amqp091-go (a Go AMQP 0.9.1 client) is vulnerable to protocol desynchronization and frame injection in versions prior to 1.13.0 . The root cause is in readLongstr (read.go): when a declared AMQP longstr length exceeds 0x7FFFFFFF, the function returns an empty string and a nil error inste...

CVE-2026-92363

A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sseparser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called...

CVE-2026-92362

A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Frame Parser. Performing a manipulation results in resource consumption. The attack is possible to be carried out remotely. The pull request t...

CVE-2026-92363 ag-ui-protocol ag-ui JSON sse_parser.cpp resource consumption

A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sseparser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called...

EUVD-2026-80708

A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sseparser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called...