HTTP Request Smuggling

Http4s is vulnerable to HTTP Request Smuggling. The vulnerability is due to improper handling of the HTTP trailer section, which allows an attacker—when the app is deployed behind a reverse proxy that forwards trailer headers—to bypass front-end security controls, target active users, and poison...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

Important: Red Hat Security Advisory: bind security update

An update for bind is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Jellysweep 代码问题漏洞

Jellysweep is a smart cleanup tool for media servers by Jonah Personal Developer. A code issue vulnerability exists in Jellysweep 0.12.1 and prior versions, which stems from an unvalidated URL parameter in the /api/images/cache endpoint that could result in the download of arbitrary content...

ALSA-2025:19912 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

[SECURITY] [DLA 4365-1] unbound security update

Debian LTS Advisory DLA-4365-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin November 05, 2025 https://wiki.debian.org/LTS Package : unbound Version : 1.13.1-1+deb11u6 CVE ID : CVE-2025-11411 Yuxiao Wu, Yunyi Zhang, Baojun Liu and Haixin Duan discovered that...

Important: Red Hat Security Advisory: bind9.16 security update

An update for bind9.16 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

bind: Cache poisoning due to weak PRNG

A vulnerability was found in BIND resolvers caused by a weakness in the Pseudo Random Number Generator PRNG. This weakness allows an attacker to potentially predict the source port and query ID used by BIND, enabling cache poisoning attacks. If successful, the attacker can inject malicious DNS...

CVE-2025-43449

The issue was addressed with improved handling of caches. This issue is fixed in iOS 26.1 and iPadOS 26.1. A malicious app may be able to track users between installs...

CVE-2025-43392

A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches. Mitigation Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages requir...

[SECURITY] Fedora 43 Update: uv-0.9.5-1.fc43

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

Important: bind9.16 security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989506)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989506 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active before cacheshow The function cshow was called with protecti...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989267)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989267 advisory. In the Linux kernel, the following vulnerability has been resolved: mm, slub: fix potential memoryleak in kmemcacheopen In error path, the randomseq of slub cache...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989435)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989435 advisory. In the Linux kernel, the following vulnerability has been resolved: bcache: avoid journal no-space deadlock by reserving 1 journal bucket The journal no-space deadlo...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989038)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989038 advisory. In the Linux kernel, the following vulnerability has been resolved: dax: make sure inodes are flushed before destroy cache A bug can be triggered by following comman...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988846)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988846 advisory. In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid racing on fsyncentryslab by multi filesystem instances As syzbot reported, the...

Important: bind

Issue Overview: Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12,...

bind9.16 security update

32:9.16.23-0.22.4 - Prevent cache poisoning due to weak PRNG CVE-2025-40780 - Address various spoofing attacks CVE-2025-40778 - Replace downstream fixes with upstream changes 32:9.16.23-0.22.3 - Update addresses of b.root-servers.net RHEL-18449...