SUSE-SU-2026:4113-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

More than 100,000 fake stores are out to steal your card details

Researchers at German cybersecurity company Nebty have identified “DoppelCart,” a cluster of almost 119,000 domains linked to copied online stores. The researchers describe it as the largest publicly documented fake-shop network by associated domain count. They found 118,787 .shop domains in the...

OPENSUSE-SU-2026:21823-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

SUSE-SU-2026:23700-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

SUSE-SU-2026:23720-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation - fix...

undici: undici: Denial of Service via unrequested WebSocket subprotocol

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service DoS...

SUSE CVE-2026-85024

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB...

CVE-2026-58649

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment,...

CVE-2026-86077

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86077

n8n , an open-source workflow automation platform, contained an authorization flaw in the /chat WebSocket route (specifically the canResumeOverChat function in chat-execution-manager.ts). Prior to versions 2.37.7 and 2.38.2 , a resumeToken issued to an anonymous form submitter could be replayed o...

CVE-2026-86077

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

EUVD-2026-69705

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock...

GHSA-7MJ9-2MP8-4M2P HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

Summary httpcore2 does not start TLS for wss:// connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure wss scheme. The transport flaw affects httpcore2 releases befo...

HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

Summary httpcore2 does not start TLS for wss:// connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure wss scheme. The transport flaw affects httpcore2 releases befo...

EUVD-2026-70250

HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies...

CVE-2026-84197

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...

EUVD-2026-74162

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...