CVE-2026-13117

A flaw was found in OpenVPN. An incomplete guard allows remote authenticated peers to trigger a use-after-free vulnerability during TLS Transport Layer Security session promotion. This can lead to a denial of service, making the service unavailable, or memory leakage, which could potentially expo...

CVE-2026-12996

A flaw was found in OpenVPN. This use-after-free vulnerability allows remote authenticated peers to send specially crafted packets during TLS Transport Layer Security session promotion or expiry. Successful exploitation of this flaw could lead to a denial of service, making the service unavailabl...

CVE-2026-5846

The CVE-2026-5846 entry concerns Watchfire Controller Software, where self-signed hard-coded RSA private keys and X.509 certificates are embedded in plaintext in the firmware patch binaries from Watchfire’s Remote Support filestore. This exposes TLS/HTTPS authentication and encryption for the con...

openjdk: Improve DTLS handshaking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The DTLS implementation is open to two different DoS attacks...

ALPINE-CVE-2026-13117

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

ALPINE-CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

SUSE CVE-2026-47723

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

EUVD-2026-51239

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-13117

CVE-2026-13117 relates to OpenVPN with an incomplete guard that can trigger a use-after-free during TLS session promotion. Affected are OpenVPN versions 2.6.0–2.6.20 and 2.7_alpha1–2.7.4, enabling remote authenticated peers to cause denial of service or memory leakage. Public advisories from Debi...

CVE-2026-13117

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the HTTPS Agent. An attacker can impersonate a client by exploiting PFX object-array key collisions, which may result in mutual TLS client identities being reused across requests configured...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname...

EUVD-2026-50498

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood...

EUVD-2026-50500

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion DoS...

SUSE-SU-2026:3427-1 Security update for valkey

This update for valkey fixes the following issues: - CVE-2026-56684: use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL bsc1272443. - CVE-2026-63639: corrupt stream RDB files containing a shared NACK across consume...

CVE-2026-44092

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

EUVD-2026-51027

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44092 Missing input validation / stripping of CRLF characters in SystemConfigManager

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

ALPINE-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...