kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs

A flaw was found in the Linux kernel's Wi-Fi mac80211 component. A connected WiFi 7 Access Point AP can trigger an out-of-bounds write by sending a specially crafted EPCS Enable Response action frame. This vulnerability can lead to a kernel crash, resulting in a Denial of Service DoS for the...

kernel: nfsd: don't free session slots that are still in use

A flaw was found in the Linux kernel's Network File System NFS daemon, nfsd. A remote attacker could exploit a use-after-free vulnerability in the nfsd4sequence function. This occurs when the system attempts to reduce the number of active session slots while a client is still using one of the slo...

EUVD-2026-101752

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...

EUVD-2026-101755

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

EUVD-2026-101754

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...

EUVD-2026-101739

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

EUVD-2026-101712

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

EUVD-2026-101757

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/iostruct.py of the component generate Endpoint. This manipulation of the argument sessionparams causes denial of service. The attack...

RLSA-2026:80512 Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6253 curl: libcurl: Authenticatio...

Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36061

Summary The Web UI allowed an authenticated user with administrative privileges to generate a large number of email notifications by submitting multiple user creation requests, potentially resulting in email flooding and impacting the readability and usability of recipients' mailboxes. The issue...

python36:3.6 security update

An update is available for python-nose, python-pymongo, python-PyMySQL, python-pygments, python-virtualenv, module.python-PyMySQL, python36, python-docs, module.python-pymongo, module.scipy, module.python-pygments, module.python36, module.python-sqlalchemy, python-sqlalchemy, python-wheel,...

RLSA-2026:82858 Important: python36:3.6 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-110829

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-94200

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl tlshandshake13, sslhandshake and tlsclientticketstore modules allows a malicious...

RHEL 8 / 9 : Red Hat Service Interconnect 2.2.3 Release (rpms) (Moderate) (RHSA-2026:82316)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:82316 advisory. Red Hat Service Interconnect 2.2 creates a service network, linking TCP and HTTP services across the hybrid cloud. A service network enables...

CVE-2026-110869

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...

EUVD-2026-102186

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

CVE-2026-102461: Undefined Security Weakness

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the uniqueItems keyword validation uses an On² pairwise comparison loop with no short-circuit or size limit. A remote unauthenticated attacker can submit a moderately-sized JSON array that consumes...

UBUNTU-CVE-2026-110829

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

CVE-2026-94200

Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl tlshandshake13, sslhandshake and tlsclientticketstore modules allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client decodes the extensions of a...