K000162994: Node.js vulnerabilities CVE-2026-21712 and CVE-2026-56846

Security Advisory Description CVE-2026-21712 A flaw in Node.js URL processing causes an assertion failure in native code when url.format is called with a malformed internationalized domain name IDN containing invalid characters, crashing the Node.js process. CVE-2026-56846 A flaw in Node.js HTTP/...

PT-2026-79072

Name of the Vulnerable Software and Affected Versions dropbox samly versions 0.3.0 and later Description An authentication bypass exists where an attacker can authenticate as the subject of a captured SAML assertion by resubmitting it. This occurs because the function decode idp auth resp/3 in...

CVE-2026-53424: Authentication Bypass by Capture-replay

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decodeidpauthresp/3 in lib/samly/helper.ex calls esamlsp:validateassertion/2, whose default duplicate detector is ...

RHEL 9 : libreswan (RHSA-2026:57741)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:57741 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind: BIND: Denial of Service via specially crafted DNS messages

A flaw was found in the bind component, specifically within the named daemon. This vulnerability allows a remote attacker to send specially crafted Domain Name System DNS messages. These messages, which use unusual classes or meta-classes, can trigger assertion failures in the named daemon when...

CVE-2026-76926 Reachable Assertion in Wireshark

BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76926 Reachable Assertion in Wireshark

BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76926 Reachable Assertion in Wireshark

BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76926

CVE-2026-76926 is a denial-of-service vulnerability in the BUSMASTER file parser of Wireshark , affecting versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 . Unlike most other CVEs in the same batch which cause crashes, this issue results in an abnormal exit of the parser when processing a crafted BUSM...

Replay Attack

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Replay Attack through improper handling of the prepareForLogin process. An attacker can gain unauthorized access by replaying a previously captured...

Replay Attack

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Replay Attack through improper handling of the prepareForLogin process. An attacker can gain unauthorized access by replaying a previously captured...

EUVD-2026-62502

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator...

BIT-MONGODB-2026-13073 MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...

CVE-2026-76926: Reachable Assertion

BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

PT-2026-78396

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description The software fails to persist the WebAuthn login challenge generated by the prepareForLogin function because the WebAuthn controller does not save the mutated key objects back to the database. Durin...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103695)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103695 advisory. If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit...

DEBIAN-CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62289

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heifimagehandlegetimagetilinghandle, 1, &tiling is called...