CVE-2026-79994: Time-of-check Time-of-use (TOCTOU) Race Condition

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

Security Bulletin: Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

Summary A security vulnerability was identified in the code security scanner where the DANGEROUSIMPORTS blocklist incompletely addressed network-based code execution risks. While subprocess module imports were correctly blocked, socket and urllib standard library modules were omitted from the...

CVE-2026-12944

IBM Langflow OSS 1.0.0 through 1.10.0 contains a vulnerability in its code security scanner where the DANGEROUS_IMPORTS blocklist correctly blocked subprocess but omitted the socket and urllib standard library modules. This allowed authenticated users to submit components containing socket.connec...

CVE-2026-12944 Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

CVE-2026-12944 Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

CVE-2026-15924

Zephyr's TLS socket layer in subsys/net/lib/sockets/socketstls.c keeps a single process-global array, clientcache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tlssessionsave, tlssessionget, tlssessioncachereset, and the settings...

CVE-2026-54632 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

CVE-2026-54632 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

CVE-2026-54632 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

CVE-2026-54632

SIPSorcery is a C#/.NET WebRTC, SIP, and VoIP library (NuGet). Prior to 10.0.9 , a single malformed UDP datagram sent to the RTP/ICE socket can remotely terminate an active media session (availability impact only). The root cause combines two issues: unchecked byte indexing in RTPChannel.OnRTPPac...

EUVD-2026-77776

Zephyr's TLS socket layer in subsys/net/lib/sockets/socketstls.c keeps a single process-global array, clientcache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tlssessionsave, tlssessionget, tlssessioncachereset, and the settings...

CVE-2026-84445

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

CVE-2026-90463

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

DEBIAN-CVE-2026-90463

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

CVE-2026-90996

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...

CVE-2026-90994

A vulnerability in sssd (System Security Services Daemon) allows a local denial of service via the PAM responder's protocol v1 parser , specifically the function pam_parse_in_data() . An attacker with access to the PAM responder's UNIX socket can negotiate protocol v1 and send an empty or truncat...

CVE-2026-90994 Sssd: sssd: denial of service via malformed pam v1 requests

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

CVE-2026-90463 Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

CVE-2026-90463 Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

EUVD-2026-77592

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...