OESA-2026-4637 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced...

OESA-2026-4635 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced...

EUVD-2026-112679

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

CVE-2026-85498

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

BIT-RCLONE-2026-116193 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...

BIT-NODE-2026-106072

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity did not classify these hosts as IP...

Security update for rust-keylime

This update for rust-keylime fixes the following issue: CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc1287921...

Security update for rust-keylime

This update for rust-keylime fixes the following issue: CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc1287921...

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift , is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco...

Strengthening API and MCP Security Through Token Risk Detection with Thales Imperva API Security

Security teams can now investigate six token risks directly at the endpoint level, making it easier to prioritize findings and take action across their API estate. APIs depend on tokens to authenticate requests and control access. But weak signing algorithms, excessive token lifetimes, exposed...

CVE-2026-118030

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

CVE-2026-117859

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

EUVD-2026-112640

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

EUVD-2026-112639

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

CVE-2026-118174

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as...

CVE-2026-118030

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

CVE-2026-118030

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An...

CVE-2026-117859

A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an...

CVE-2026-116773

A flaw was found in russh. An unbounded memory allocation issue allows a malicious Secure Shell SSH server to cause a Denial of Service DoS on connecting clients. By repeatedly sending crafted pre-authentication extension packets, the server forces the client to store an unlimited number of...

CVE-2026-116684

A flaw was found in the Model Context Protocol MCP Python SDK. This vulnerability allows a remote authenticated attacker to bypass authentication and gain unauthorized access to an MCP server by presenting a valid token issued for a different service. The issue occurs because server-side...