PT-2026-102480

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.8 Wireshark versions 4.4.0 through 4.4.18 Description A crash in the SCTP protocol dissector allows a denial of service. A dissector is a software component that breaks down network traffic into a...

openSUSE 16: libwireshark18 / libwiretap15 / libwsutil16 / wireshark / etc (openSUSE-SU-2026:21534-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21534-1 advisory. Update to version 4.4.17. - CVE-2026-6867: SMB2 protocol dissector crash bsc1263727. - CVE-2026-7375: UDS protocol dissector infinite loop...

PT-2026-78840

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 Description A crash in the C12.22 protocol dissector allows a denial of service. A dissector is a software component that breaks down network traffic into a...

Cisco IOS XE Software SNMP DoS (cisco-sa-iosxe-snmp-dos-ZAqNm4MD)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. - A vulnerability in the SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due ...

Cisco IOS XE Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)

According to its self-reported version, Cisco IOS-XE Software is affected by a denial of service vulnerability. A flaw exists in the Extensible Messaging Client Protocol XMCP due to improper handling of malformed XMCP packets. An unauthenticated, remote attacker can exploit this issue, via a...

Nmap Port Scanner 7.991

Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols UDP, TCP, ICMP, etc...

Cisco IOS Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)

According to its self-reported version, Cisco IOS is affected by a denial of service vulnerability. A flaw exists in the Extensible Messaging Client Protocol XMCP due to improper handling of malformed XMCP packets. An unauthenticated, remote attacker can exploit this issue, via a malformed XMCP...

Cisco IOS XE SNMP DoS

The vulnerability of the Simple Network Management Protocol SNMP subsystem in Cisco IOS XE lies in the fact that resources are not released after their useful period has expired. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

SUSE CVE-2026-64564

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctprcv. For an ASCONF located...

SUSE CVE-2026-68743

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

CVE-2026-71324

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

UBUNTU-CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

h2: Duplicate Host header could facilitate request smuggling

Impact h2 =4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive CWE-444...

CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

Summary The AttributesExtension's href/src unsafe-link filter AttributesHelper::filterAttributes can be bypassed by embedding control bytes in a javascript: URL that browsers discard before parsing the scheme. Two variants: - Tab/newline inside the scheme — a literal ASCII TAB 0x09, CR 0x0D, or...

CVE-2026-5855

Contiki-NG: LwM2M TLV parser in os/services/lwm2m/lwm2m-tlv.c (function lwm2m_tlv_read) ignores the caller’s buffer length and may read up to six bytes without bounds checks. The engine loop continues while bytes remain, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exact...

CVE-2026-54463

A flaw was found in websocket-driver, a WebSocket protocol handler. A remote attacker could exploit a vulnerability in how draft versions of the WebSocket protocol handle length headers. By sending an indefinite sequence of specially crafted bytes, an attacker can cause the affected component to...

MAL-2026-13436 Malicious code in @wbnr/frontend-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6208a0da32b8b7ae795d85ecbf95788b876729db08b0a595ad24f05a02dbbdbe The package declares a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script reads the installer's OS username...