SUSE-SU-2026:3995-1 Security update for wireshark

This update for wireshark fixes the following issues: - CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops bsc1271133. - CVE-2026-15164: Denial of Service vulnerability in ciscodump bsc1271134. - CVE-2026-15167: Denial of Service via DBS Etherwatch file parser crash...

Security update for wireshark

This update for wireshark fixes the following issues: CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops bsc1271133. CVE-2026-15164: Denial of Service vulnerability in ciscodump bsc1271134. CVE-2026-15166: Denial of Service via IEEE 802.11 protocol dissector crash...

SUSE-SU-2026:3994-1 Security update for wireshark

This update for wireshark fixes the following issues: - CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops bsc1271133. - CVE-2026-15164: Denial of Service vulnerability in ciscodump bsc1271134. - CVE-2026-15166: Denial of Service via IEEE 802.11 protocol dissector...

CVE-2022-51016: Authentication Bypass by Capture-replay

PocketMine-MP 3.x before 3.27.0 does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session for example by tricking t...

PT-2026-86778

PocketMine-MP 3.x before 3.27.0 does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session for example by tricking t...

Linux Distros Unpatched Vulnerability : CVE-2026-16028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a...

CVE-2026-16028: Missing Release of Memory after Effective Lifetime

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

The vulnerability of the Authentication Engine component of the Oracle Access Manager access control system allows a perpetrator to gain full control over the application.

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTP network protocol...

PT-2026-86914

Name of the Vulnerable Software and Affected Versions Protocol::HTTP2 versions prior to 1.14 Description An issue exists where memory exhaustion can occur because closed streams are not removed from the connection stream table by the stream state function. When a stream reaches the CLOSED state,...

CVE-2026-86351: URL Redirection to Untrusted Site

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

TencentOS Server 4: freerdp (TSSA-2026:0966)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0966 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

PT-2026-86679

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

The vulnerability of the SSH protocol implementation in the RouterOS operating system of MikroTik allows a hacker to bypass security restrictions and gain read-only access to data.

The vulnerability of the SSH protocol implementation in the RouterOS operating system of MikroTik is related to errors in verifying the cryptographic signature during the incorrect comparison of the RSA public key assigned to the user. Exploiting this vulnerability allows a malicious actor to...

The vulnerability of the SSH protocol implementation in the RouterOS operating system of MikroTik allows a hacker to increase their privileges.

The vulnerability of the SSH protocol implementation in the RouterOS operating system of MikroTik is related to changes in the user trust policy mask due to the introduction or modification of arguments. Exploiting this vulnerability can allow a malicious actor to increase their privileges remote...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-8725-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8725-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

CVE-2026-86205

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

CVE-2026-86205 h3 before 2.0.1-rc.18 Open Redirect via redirectBack()

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

EUVD-2026-72105

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

CVE-2026-86205 h3 before 2.0.1-rc.18 Open Redirect via redirectBack()

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

CVE-2026-86205

h3 versions before 2.0.1-rc.18 are affected by an open redirect vulnerability in the redirectBack() utility. The root cause is a failure to sanitize protocol-relative paths in the Referer header pathname: an attacker can craft a same-origin URL containing a double-slash path segment that passes o...