CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-84933

undici , the Node.js HTTP client library, has a flaw in its cache interceptor that fails to handle the Set-Cookie response header in its cache path—neither refusing to store nor stripping it. In shared cache mode (the default), a cacheable response carrying a Set-Cookie header is stored and re-se...

CVE-2026-84933 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-80813

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

CVE-2026-80763

CVE-2026-80763 is an out-of-bounds read in the Linux kernel Bluetooth HCI subsystem. In hci_cc_le_set_cig_params(), the handler trusts the num_handles field of the LE Set CIG Parameters Command Complete response and reads the trailing handle array without verifying that the remaining skb data act...

CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

PT-2026-91360

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci cc le set cig params...

PT-2026-86267

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param set default file and param set backup file functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any P...

PT-2026-85622

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hid set field hid set field hands field-usage + offset to hid dump input before the guard that bounds offset: hid dump inputfield-report-device, field-usage + offset, value; if offset =...

CVE-2026-80763: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

PT-2026-86152

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The cache interceptor fails to handle the Set-Cookie response header, allowing it to be stored and re-served in shared cache mode. This occurs when a cacheab...

PT-2026-85604

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci cc le set cig params...

PT-2026-91367

In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated xattr cache entries ext4 xattr block set retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry returns to the mbcache lookup without...

PT-2026-91791

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport header when sending VLAN-tagged frame In packet parse headers, when processing a VLAN-tagged frame, skb set network header is called to advance network header past the VLAN tag to the inner protoc...

CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

Linux Distros Unpatched Vulnerability : CVE-2026-84933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-84185

CVE-2026-84185 affects the jwcrypto library, a Python implementation of the JOSE (JSON Object Signing and Encryption) standards. The flaw occurs during verification of a General JSON Serialization JWS against a key set (JWKset): due to a coding error, the library fails to correctly match the key ...

kernel: netfilter: nf_tables: don't skip expired elements during walk

A flaw was found in the Linux kernel. Improper management of the lifecycle of some nftables objects could result in consumption of all system memory. An attacker who can create nftables rules could use this to effect a Denial of Service...