Node.js Module axios 1.13.0 < 1.18.0 maxBodyLength Bypass (CVE-2026-67318)

The version of the axios Node.js module installed on the remote host is 1.13.0 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios fails to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2...

FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream

A flaw was found in FFmpeg's RASC video decoder. A remote attacker could exploit this by providing a crafted media stream using the RASC FourCC Four Character Code, which is then decoded by libavcodec. This vulnerability triggers a bitstream-controlled out-of-bounds heap write and an adjacent...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.1 Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untruste...

EulerOS 2.0 SP13 : mutt (EulerOS-SA-2026-2982)

According to the versions of the mutt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP authcram MD5 digest.CVE-2026-43859 In mutt before 2.3.2, the imapauthgss...

A Bootiful Podcast: Data guru Gregory Green on RabbitMQ, Valkey, Gemfire, Data Flow, and more

Hi, Spring and data fans! Want a faster, smarter data stack? Tune into this episode with Gregory Green for a deep dive into GemFire, RabbitMQ Streams, Dataflow, and more. We cover real-time event processing, active-active consistency, full-text search, vector search, and how to build resilient,...

netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a large number of HTTP/2 stream requests to a Netty HTTP/2 server. If the server does not explicitly limit concurrent streams, it can lead to the allocation of numerous long-liv...

PYSEC-2026-3610 pypdf: Possible long runtimes for repeated malformed cross-reference entries

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consider applying the changes fr...

PYSEC-2026-3612 pypdf: Possible infinite loop for not terminated inline images

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. Patches This has been fixed in pypdf==6.14.1. Workarounds If yo...

This Week in Spring - August 4th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's the 4th of August! We're already in month eight of this year! Great Scott! This is an interesting project to help ensure idempotency keys for Spring Boot requests A very interesting post on The New Stack titled, When...

CVE-2026-67317

A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to...

CVE-2026-67302

A flaw was found in FreeRDP, a remote desktop protocol client. A malicious or compromised RDP server can exploit this vulnerability by sending a specially crafted StartStreamsRequest with a zero value for FrameRateDenominator. If camera redirection is enabled on the client, this action triggers a...

CVE-2026-67975

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...

Linux Distros Unpatched Vulnerability : CVE-2026-67317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be...

CVE-2026-67317

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource...

CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

EUVD-2026-51834

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

CVE-2026-67302

CVE-2026-67302 affects FreeRDP before 3.29.0 (versions ≤ 3.28.0) and targets the rdpecam camera redirection client. A StartStreamsRequest with a server-controlled CAM_MEDIA_TYPE_DESCRIPTION may include a zero FrameRateDenominator; ecam_dev_process_start_streams_request() only validates Format and...

CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

CVE-2026-67302 FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...