CVE-2026-90161 erofs: fix interlaced ztailpacking pclusters

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

CVE-2026-90102 NFSv4/pnfs: key the data server cache on the NFS version

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

CVE-2026-85077

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

CVE-2026-85077

A flaw was found in Sanic. The HTTP/1.1 response pipeline does not properly validate carriage-return or line-feed characters in response header names and values. This allows applications that place attacker-controlled data in response headers, filenames, or cookie attributes to inject additional...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Summary A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. Details The CORS plugin previously copied the request's Vary header directly onto the response instea...

EUVD-2026-80991

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass...

CVE-2026-85077

Sanic , an open-source Python web server/framework, is affected by an HTTP response header injection vulnerability (CVSS 3.1: 8.2 HIGH ). The root cause resides in the HTTP/1.1 response pipeline in sanic/response/types.py , which serializes header names and values without rejecting carriage-retur...

CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

Security Bulletin: IBM QRadar SOAR is vulnerable to using components with known vulnerabilities (CVE-2026-73088, CVE-2026-73089)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar SOAR has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-73088 DESCRIPTION: Browserslist is a configuration tool fo...

unbound security update

An update is available for unbound. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unbound packages provide a validating, recursive, and caching DNS or...

RLSA-2026:68291 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

A flaw was found in the Linux kernel's handling of RAW sockets using IPPROTORAW. A remote attacker could send a specially crafted ICMP Internet Control Message Protocol packet. This malicious packet could set the protocol field to 255, causing it to be processed by a RAW socket configured for...

Malicious Package

Overview leda-command-superagent-cache is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

A flaw was found in the Linux kernel's handling of RAW sockets using IPPROTORAW. A remote attacker could send a specially crafted ICMP Internet Control Message Protocol packet. This malicious packet could set the protocol field to 255, causing it to be processed by a RAW socket configured for...

CVE-2026-92718

A flaw was found in Nuclei. An attacker can exploit a vulnerability in how Nuclei caches template signature verification. By replacing verified templates with malicious content and restoring the original modification time, an attacker can bypass signature checks, leading to the execution of...