Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

GHSA-R4J5-9XPP-3985 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

CVE-2026-103382

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...

CVE-2026-103382

The Casso Flow WordPress plugin, versions prior to 4.2.0 , contains a vulnerability where it fails to properly authenticate incoming bank-transfer payment notifications. On a default installation, the verification token is empty, which allows unauthenticated attackers to forge notifications and m...

EUVD-2026-111698

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...

CVE-2026-103382 Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...

ROS-20261028-73-0006

The sshd vulnerability in the OpenSSH cryptographic suite is related to access control flaws. Exploitation of this vulnerability enables a local attacker to escalate privileges by utilizing undefined vectors associated with serverloop.c, thereby creating a Unix domain transfer socket as a superus...

Linux Distros Unpatched Vulnerability : CVE-2026-81038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Object Transfer Service server builds its Object Action Control Point OACP response indication in oacpindsend subsys/bluetooth/services/ots/otsoacp.c. Befor...

PT-2026-127815

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...

CVE-2026-103382: Unknown Casso Flow: The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment…

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...

CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-117469 File-transfer type confusion permits unauthorized repository writes in Psono Server

Psono Server CE & EE versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an...

CVE-2026-117469

Psono Server (CE & EE) versions 1.0.0 through 7.2.3 are vulnerable to a file-transfer type confusion flaw. The software fails to enforce the correct direction of file-transfer credentials during repository operations. An authenticated remote attacker with read-only access can exploit this by pres...

CVE-2026-117469 File-transfer type confusion permits unauthorized repository writes in Psono Server

Psono Server CE & EE versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an...

CVE-2026-115927

A flaw was found in Tornado. When decoding HTTP/1.1 chunked transfer encoding, Tornado processes received data without yielding control back to the event loop. A remote unauthenticated attacker can send requests containing a large volume of small chunks to monopolize the process and consume...

CVE-2026-116844 Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P

Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the...

CVE-2026-116844

The fclairamb ftpserverlib (versions through 0.32.4 ) is vulnerable to a cleartext transmission flaw. The root cause lies in the TransferOpen function, which verifies only the transferTLS flag set by the PROT command but fails to confirm if the actual data connection utilizes TLS. Consequently, w...

CVE-2026-116844 Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P

Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the...

Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak

Multimodal large language models MLLMs are vulnerable to visual jailbreak attacks that bypass safety safeguards. Existing methods typically optimize isolated adversarial examples, limiting attack diversity, transferability, and generalization. We propose Jailbreak Connectivity JC, a framework bas...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-hardening-ise-XU5EwX5T)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a...