io.zipkin.zipkin2:zipkin-collector-rabbitmq (>=2.14.1, <=2.14.2), org.apache.zipkin.reporter2:zipkin-reporter-spring-beans (2.8.3) +2 more potentially affected by CVE-2026-75516 via com.rabbitmq:amqp-client (4.11.0)

com.rabbitmq:amqp-client MAVEN version 4.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.zipkin2:zipkin-collector-rabbitmq =2.14.1, =2.14.2 -...

com.github.marcelop3251:queues-manager (1.2.0), com.rabbitmq.jms:rabbitmq-jms (>=1.13.0, <=1.14.0) +9 more potentially affected by CVE-2026-75516 via com.rabbitmq:amqp-client (4.11.3)

com.rabbitmq:amqp-client MAVEN version 4.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.marcelop3251:queues-manager 1.2.0 - com.rabbitmq.jms:rabbitmq-jms =1.13.0, =1.3.15-1, =2.10.2,...

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Vulnerability In AMQConnection.java line 435-436, after Connection.Tune negotiation, the frame-max limit is set via: java frameHandler.setFrameMax Math.minthis.maxInboundMessageBodySize, frameMax; When frameMax = 0 meaning "unlimited" per AMQP spec, Math.min67108864, 0 = 0. This value is then...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the inbound frame size handling in AMQConnection.java. An attacker can trigger excessive frame allocation and crash the client by negotiating framemax=0 and then sending an...

fastrepl-client (0.0.1) potentially affected by CVE-2026-59823 via litellm (0.4.4)

litellm PYPI version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl-client 0.0.1 Source cves: CVE-2026-59823 Source advisory: OSV:GHSA-HX8V-G79F-8W5F...

valkey: Valkey: Remote code execution via TLS pending-data processing use-after-free

A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport...

BIT-MONGODB-2026-18703 Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

Malicious code in kinopoisk-yav-client (npm)

The package kinopoisk-yav-client was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kafka-client-ruby (npm)

The package kafka-client-ruby was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jwt-angular11-client (npm)

--- Credit: OpenSSF source...

firefox: thunderbird: Sandbox escape in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Remote Settings Client component...

CLEANSTART-2026-JQ49818 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Multiple security vulnerabilities affect the minio-client package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

ALSA-2026:68549 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM: Workers component CVE-2026-16365 firefox: thunderbird: Sandbox escape in the Remote Settings Client component...

CVE-2026-90220: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-81868: Authentication Bypass Using an Alternate Path or Channel

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

PT-2026-94384

Name of the Vulnerable Software and Affected Versions Steeltoe versions prior to 4.3.0 Description Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate provided in the X-Client-Cert request header without...

PT-2026-95074

Name of the Vulnerable Software and Affected Versions AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 Description Improper validation of certificates with host mismatch occurs in the MQTT client TLS connection layer, specifically affecting X.509 mutual authentication on port 8883 and...

PT-2026-94499

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NFSv4 implementation where the nfs4 alloc client function allocates a callback identifier before completing client setup. If a subsequent initialization step fails...

PT-2026-94473

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A request buffer leak exists in the asynchronous read path of the SMB client. The function smb2 new read req allocates a request buffer using smb2 plain req init, but fails to release th...

PT-2026-94296

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.12.0 through 4.14.x ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description AshAuthentication contains an issue where readers of the audit store can recover client IP addresses that the audit log...