python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability

A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names IDNA...

python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability

A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names IDNA...

python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability

A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names IDNA...

openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap

A flaw was found in the OpenSSL CMS implementation RFC 3211 KEK Unwrap. This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption PWRI...

Moderate: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2026-17084

A flaw was found in the Python 'stringprep' module. This module incorrectly processed characters by using the latest Unicode codepoint attributes instead of the Unicode 3.2.0 standard specified in RFC 3454. This deviation can lead to mismatches when processing internationalized domain names IDNA...

PT-2026-94114

Name of the Vulnerable Software and Affected Versions Nodemailer versions 6.9.16 through 9.0.x Description Nodemailer mis-parses RFC 5322 comments within email addresses. In the lib/addressparser component, when a comment is closed immediately before a non-break character, the tokenizer...

Security update for aws-nitro-enclaves-cli (important)

openSUSE security update: security update for aws-nitro-enclaves-cli ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21782-1 Rating: important References: bsc1257933 bsc1270202 bsc1274300 Cross-References: CVE-2026-25541 CVE-2026-25727 CVE-2026-4167...

PT-2026-95045

Summary Nodemailer's email-address parser treats an RFC 5322 comment ... inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace CFWS that terminates the domain. Consequently a recipient address such as [email protected] is parsed and delivere...

SUSE-SU-2026:23643-1 Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes bsc1274300. - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion...

Improper Access Control

Spring Data REST is vulnerable to Improper Access Control. The vulnerability is due to insufficient protection of identifier @Id and version @Version properties from mutation through RFC 6902 JSON Patch requests, which allows an attacker to modify these properties and potentially alter resource...

Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes bsc1274300. CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion...

SUSE CVE-2026-56855

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

Linux Distros Unpatched Vulnerability : CVE-2026-56855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC...

CVE-2026-85179

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179

Label Studio versions through 1.23.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the webhook functionality (specifically in webhooks/utils.py). The application fails to validate webhook URLs , allowing authenticated users to dispatch outbound requests to internal network...

Linux Distros Unpatched Vulnerability : CVE-2026-63435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and...

CVE-2026-85179: Server-Side Request Forgery (SSRF)

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

PT-2026-85038

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

Mail: Email address spoofing via malformed RFC 2047 encoded-words

Summary Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded...