UBUNTU-CVE-2026-97629

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

Unity Linux 20.1070e Security Update: openvpn (UTSA-2026-130406)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130406 advisory. A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memor...

Unity Linux 20.1070e Security Update: sqlite (UTSA-2026-130356)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130356 advisory. An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup...

Linux Distros Unpatched Vulnerability : CVE-2026-55167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with...

Linux Distros Unpatched Vulnerability : CVE-2026-110838

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers t...

UBUNTU-CVE-2026-105236

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI nam...

CVE-2026-110809

A security vulnerability exists in sgl-project SGLang versions up to 0.5.19 . The flaw is located in the Session Cleanup component, specifically within the Session.create_req function in the file python/sglang/srt/session/session_controller.py. Improper resource handling allows an attacker to per...

CVE-2026-110809

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.createreq of the file python/sglang/srt/session/sessioncontroller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be...

CVE-2026-110809 sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.createreq of the file python/sglang/srt/session/sessioncontroller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be...

CVE-2026-110809 sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.createreq of the file python/sglang/srt/session/sessioncontroller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be...

DEBIAN-CVE-2026-110838

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...

CVE-2026-110838

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...

CVE-2026-110838

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...

erlang: erlang: Authentication bypass via TLS session resumption across virtual hosts

A flaw was found in Erlang/OTP. This issue allows a remote attacker to bypass authentication and gain unauthorized access to protected services. When multiple virtual hosts share a listener, the Transport Layer Security TLS session cache does not bind cached sessions to the specific Server Name...

erlang: Erlang: Denial of Service via malformed TLS 1.3 session ticket

A flaw was found in Erlang's SSL application. A malicious Transport Layer Security TLS server can cause a Denial of Service DoS across client connections by returning an improperly formatted session resumption ticket with an empty early data extension. When the client attempts to automatically...

CVE-2026-110862 Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state ...

CVE-2026-110862 Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state ...

CVE-2026-110847

The n8n workflow automation tool contains a Stored Cross-Site Scripting (XSS) vulnerability in the Chat Trigger hosted-chat page. This issue exists in versions before 1.123.83 , 2.x before 2.41.4 , and 2.42.x before 2.42.1 . The root cause is the interpolation of insufficiently sanitized customCs...

CVE-2026-110838

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...

CVE-2026-110838

The FreeRDP shadow server versions 3.0.0 before 3.32.0 is vulnerable to a pre-authentication input injection flaw. The vulnerability occurs because the server dispatches input Protocol Data Units (PDUs) during the Confirm Active state before authentication is complete. An unauthenticated attacker...