Security Bulletin: IBM MQ .NET client is vulnerable to remote code execution (CVE-2026-11728)

Summary IBM MQ has addressed a heap buffer overflow vulnerability in the IBM MQ .NET client's asynchronous message receive handler Vulnerability Details CVEID:CVE-2026-11728 DESCRIPTION: IBM MQ .NET Client could allow a remote attacker to cause a denial of service or potentially execute arbitrary...

Linux Kernel IPv6 VTI Subsystem Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of...

[SECURITY] Fedora 45 Update: libevent-2.1.13-1.fc45

The libevent API provides a mechanism to execute a callback function when a specific event occurs on a file descriptor or after a timeout has been reached. libevent is meant to replace the asynchronous event loop found in event driven network servers. An application just needs to call eventdispat...

PT-2026-90080

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Renesas I3C driver employs an asynchronous model for data transfer by preparing a renesas i3c xfer structure, enqueuing it, and waiting for completion. A race condition occurs when a...

Python Library Tornado < 6.5.8 DoS (CVE-2026-82397)

The version of the Tornado Python package installed on the remote host is prior to 6.5.8. It is, therefore, affected by a denial of service vulnerability: - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded...

Cleartext Transmission of Sensitive Information

Overview httpcore2 is an A minimal low-level HTTP client. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the synchronous and asynchronous SOCKS5 connection implementations, which decide whether to start TLS by testing for the https scheme...

Linux Distros Unpatched Vulnerability : CVE-2026-80787

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet: pci-epf: fix use-after-free in nvmetpciepfexeciodwork nvmetpciepfexeciodwork submits an I/O command with req-execute and then waits for the command to...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...

EUVD-2026-42399

asyncssh has SCP Path Traversal to Arbitrary File Write...

CVE-2026-80547

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

UBUNTU-CVE-2026-80547

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80547: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

Libevent Buffer Overflow DoS

The vulnerability of the buffereventsocketsetconnaddress function in the Libevent asynchronous event library is related to writing beyond the buffer’s boundaries. Exploiting this vulnerability could allow an attacker to cause a service failure...

UBUNTU-CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netfs: Fixed the issue of using collection offloading during writing operations. The issue was addressed by fixing the process of setting NETFSRREQOFFLOADCOLLECTION during writes, so that collections are processed asynchronously,...

CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

CVE-2026-53533 aiosmtplib: SMTP command injection via CR/LF in sender/recipient address

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail, SMTP.rcpt, SMTP.vrfy, and SMTP.expn send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an...

CVE-2026-75851

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...