CVE-2026-54156 node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...

CVE-2026-54156 node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...

CVE-2026-54156 node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...

EUVD-2026-77624

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...

CVE-2026-54156

node-opcua (an OPC UA implementation for TypeScript/Node.js) versions >=2.1.9 through

CVE-2026-90940

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...

CVE-2026-90940 novel-plus through 5.3.3 Default Cache Management Password in the Front Portal

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...

EUVD-2026-77484

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...

CVE-2026-90940

novel-plus through version 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint. The hardcoded default value is exposed in the URL path, allowing anonymous attackers (no privileges required) to trigger unauthorized portal cache invalidation. Th...

CVE-2026-90940 novel-plus through 5.3.3 Default Cache Management Password in the Front Portal

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...

CVE-2026-90940 novel-plus through 5.3.3 Default Cache Management Password in the Front Portal

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation ...

Astra Linux – Vulnerability in Firefox and Thunderbird

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved handling of caches. This issue has been fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26. It is possible for a website to access sensor information without user consent...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Nilfs2: Fixed potential deadlocks caused by newly created symlinks. Syzbot reported that pagesymlink, called by nilfssymlink, triggers memory reclamation involving the filesystem layer. This can lead to circular lock dependencies...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm cache: Fixed potential out-of-bounds access during the first resume. Out-of-bounds access occurs when the fast device is unexpectedly expanded before the first resume of the cache table. This happens because expanding the fast...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Ensure that the cache entry is active before calling cacheshow. The function cshow was called with protection from RCU. This only ensures that cp will not be freed. As a result, the reference count of cp can drop to zero,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfsd: Ensure that exp remains active before calling svcexportshow. The function eshow was called with protection from RCU. This only ensures that exp will not be freed. As a result, the reference count of exp can drop to zero,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dmarraycursorend: Fix to prevent releasing a faulty array block twice when using dmarraycursorend. When dmbmreadlock fails due to locking or checksum errors, it releases the faulty block implicitly, leaving an invalid output...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: fixed the issue where shmem xarray updates occur during migration. A shmem folio can be either in the page cache or in the swap cache, but not both at the same time. Specifically, once it is in the swap cache,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: atm: Fixed NULL pointer dereference issue When MPOAcacheimposrcvd receives the message, it may trigger a NULL Pointer Dereference Vulnerability if both the entry and holdingtime parameters are NULL. Since this only occurs when...