CVE-2026-100658

A flaw was found in Netty. An unbounded memory queue in the WebSocket server extension handler allows an unauthenticated remote attacker to cause a Denial of Service DoS. By sending pipelined HTTP requests faster than the server produces responses, an attacker can force the connection queue to gr...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses IBM Java that has been affected by buffer overflow vulnerability in OMR allows denial-of-service (CVE-2026-1188)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM Java that has been affected by buffer overflow vulnerability in OMR allows denial-of-service. This issue has been addressed in this release. Vulnerability Details CVEID:CVE-2026-1188 DESCRIPTION: In the Eclipse OMR port...

CVE-2026-97535

A flaw was found in the Linux kernel's qla2xxx driver. A local user can cause a Denial of Service DoS via a system crash by triggering an out-of-bounds memory write during virtual port management. This issue occurs because the driver fails to validate virtual port index numbers against the fixed...

USN-8833-1: libvirt vulnerabilities

It was discovered that libvirt did not properly validate newline characters in DNS TXT record values and SRV record attributes in its virtual network driver. A local attacker with permission to define virtual networks could possibly use this issue to inject arbitrary dnsmasq configuration...

USN-8833-1 libvirt-hwe vulnerabilities

It was discovered that libvirt did not properly validate newline characters in DNS TXT record values and SRV record attributes in its virtual network driver. A local attacker with permission to define virtual networks could possibly use this issue to inject arbitrary dnsmasq configuration...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpConversionUtil.toHttp3HeadersHttpMessage, boolean, reached through Http3FrameToHttpObjectCodecfalse, which processes the Host header before the authority carried in an absolute-form request-target, so a...

CVE-2026-100659

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

EUVD-2026-87753

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:21955-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21955-1 advisory. Changes in gitoxide: - CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path, allowing virtual-host...

CVE-2026-19775

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-19775 OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

EUVD-2026-86539

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f...

CVE-2026-19775

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 1.1.7 . The root cause is the plugin's failure to properly verify user authorization before performing certain actions. This flaw a...

Security update for gitoxide (moderate)

openSUSE security update: security update for gitoxide ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21955-1 Rating: moderate References: bsc1281749 Cross-References: CVE-2026-91986 CVSS scores: CVE-2026-91986 SUSE : 5.4...

WordPress OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin Desktop Mode versions = 1.1.7...

CVE-2026-93604

A flaw was found in vm2. Untrusted guest code can exploit this vulnerability when the crypto builtin is explicitly allowlisted for a NodeVM Node.js Virtual Machine. By calling the crypto.setFips function, an attacker can modify the FIPS Federal Information Processing Standards mode of the entire...

OPENSUSE-SU-2026:21955-1 Security update for gitoxide

This update for gitoxide fixes the following issues: Changes in gitoxide: - CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path, allowing virtual-host spoofing boo1281749...

CVE-2026-66079

A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted 19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the...

CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...

ROS-20260923-73-0012

The vulnerability of the kvmresetdirtygfn function in the virt/kvm/dirtyring.c module of the Kernel-based Virtual Machine KVM subsystem of the Linux operating system is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise...