PT-2026-65899

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem reads and parses an entire JSON-RPC POST body without enforcing a size limit. This allows an unauthenticated remote attacker...

PT-2026-65888

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem fails to validate the HTTP Host or Origin request headers. This allows a malicious browser page to utilize DNS rebinding—a...

PT-2026-65746

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

Linux Distros Unpatched Vulnerability : CVE-2026-54345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fix...

The vulnerability of the inet_diag_msg_sctpladdrs_fill() function in the net/sctp/diag.c module of the Linux operating system’s kernel implementation of the SCTP protocol allows a attacker to cause a service failure.

The vulnerability of the inetdiagmsgsctpladdrsfill function in the net/sctp/diag.c module of the SCTP protocol implementation in the Linux operating system is related to synchronization errors when using a shared resource “Race Condition”. Exploiting this vulnerability can allow an attacker to...

Linux Distros Unpatched Vulnerability : CVE-2026-58158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through...

Linux Distros Unpatched Vulnerability : CVE-2026-50735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in...

The vulnerability of the ipv4 component in the Linux operating system’s kernel allows attackers to increase their privileges and cause service interruptions.

The vulnerability of the ipv4 component in the Linux operating system’s kernel is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to increase their privileges and cause service interruptions...

PT-2026-65898

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem fails to bind a session ID to a session owner. This allows an attacker who has obtained a stolen session ID to send tools/ca...

Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and 1756-EN4TR Improper Check for Certificate Revocation (CVE-2026-9636)

The affected products fail to properly reject certificates signed by an intermediate certificate authority that has been revoked via a Certificate Revocation List CRL. A network-based attacker who holds such a certificate can leverage it to establish a Common Industrial Protocol CIP Security...

PT-2026-65897

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem does not expire sessions by default. Consequently, repeated initialize requests lead to the retention of unbounded...

IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 / Liberty 17.0.0.3 < 26.0.0.8 (7281625)

The version of IBM WebSphere Application Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7281625 advisory. - IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP...

Rockwell Automation CompactLogix Improper Validation of Integrity Check Value (CVE-2025-11694)

A security issue exists within the affected CompactLogix 5370 controllers due to missing validation of sequence numbers and source IP addresses in the CIP protocol. An attacker can abuse the exposed Connection IDs visible on the controller's web interface to send forged CIP packets, resulting in ...

The vulnerability of the `fnhe_remove_oldest()` function in the `net/ipv4/route.c` module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the fnheremoveoldest function in the net/ipv4/route.c module of the Linux operating system is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-65735

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap sock new connection cb l2cap sock new connection cb returned l2cap pisk-chan after release sockparent. Once the parent lock is dropped the newly enqueued child socket sk is reachable...

CVE-2026-56821

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path...

CVE-2026-56821 Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path...

CVE-2026-54638

gotd/td, a Go MTProto client, is affected by a pre-auth denial of service in proto.UnencryptedMessage.Decode where dataLen from an unauthenticated MTProto unencrypted packet could trigger unbounded memory allocation before validating the buffer. This could cause excessive memory usage and CPU/GC ...

CVE-2026-55555

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...

UBUNTU-CVE-2026-55555

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP...