CVE-2026-87011

Open WebUI , a self-hosted AI platform, contains a denial-of-service vulnerability in the unauthenticated POST /oauth/backchannel-logout handler (backend/open_webui/utils/oauth.py). From version 0.9.0 through 0.11.1 , the handler fetched the OIDC discovery document and signing keys before validat...

Security Bulletin: Vulnerability in jackson-core affects IBM Virtualization Engine TS7700

Summary IBM Virtualization Engine TS7700 is susceptible to a Denial of Service CVE-2026-18401 threat due to the use of jackson-core. jackson-core is used by TS7700 Management Interface to serialize/deserialize JSON data. Vulnerability Details ID:WS-2026-0003 DESCRIPTION: The non-blocking async JS...

Improper Preservation Of Message Metadata

Spring Integration is vulnerable to improper preservation of message metadata. The vulnerability is due to reply and propagated headers being copied from the most recently consumed upstream message when .fluxTransform processes raw payloads asynchronously or out of order, which allows an attacker...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

CVE-2026-87011: Asymmetric Resource Consumption (Amplification)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-106771)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106771 advisory. FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When...

NPM: multer vulnerable to file size limit bypass via async fileFilter race condition

NPM: multer vulnerable to file size limit bypass via async fileFilter race condition vulnerability discovered by ? in WordPress Npm multer versions 2.3.0...

EUVD-2026-67929

multer vulnerable to file size limit bypass via async fileFilter race condition...

multer vulnerable to file size limit bypass via async fileFilter race condition

Impact When multer is configured with an asynchronous fileFilter, the limits.fileSize limit can be bypassed. The 'limit' event is registered inside the async fileFilter callback, so if a file exceeds limits.fileSize before that callback runs, the event is missed and the oversized upload is accept...

GHSA-QVFW-J98X-7Q72 multer vulnerable to file size limit bypass via async fileFilter race condition

Impact When multer is configured with an asynchronous fileFilter, the limits.fileSize limit can be bypassed. The 'limit' event is registered inside the async fileFilter callback, so if a file exceeds limits.fileSize before that callback runs, the event is missed and the oversized upload is accept...

[SECURITY] Fedora 44 Update: libre-4.11.0-1.fc44

Libre is a generic library for real-time communications with async I/O support. Features are a SIP stack RFC 3261, SDP, RTP and RTCP, SRTP and SRTCP Secure RTP, DNS client, STUN/TURN/ICE stack, BFCP, HTTP stack with client/server, Websockets, Jitter buffer, async I/O poll, epoll, select, kqueue,...

[SECURITY] Fedora 43 Update: libre-4.11.0-1.fc43

Libre is a generic library for real-time communications with async I/O support. Features are a SIP stack RFC 3261, SDP, RTP and RTCP, SRTP and SRTCP Secure RTP, DNS client, STUN/TURN/ICE stack, BFCP, HTTP stack with client/server, Websockets, Jitter buffer, async I/O poll, epoll, select, kqueue,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053406)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053406 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is...

OESA-2026-3703 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Fix sc7280 lpass potential buffer overflow Case values introduced in commit 5f78e1fb7a3e "ASoC: qcom: Add driver support for audioreach solution" cau...

SUSE CVE-2026-80811

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

SUSE CVE-2026-80872

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

SUSE CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

AZL-99525 CVE-2026-80904 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80904

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...

CVE-2026-80904 net/tls: Fail tls_sw_splice_read() after a failed async decrypt

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...