The vulnerability of the HttpClientCodec component in the networking application development framework allows attackers to compromise the integrity and accessibility of protected information, using Netty protocols.

The vulnerability of the HttpClientCodec component in the networking application development framework, used by servers and clients that utilize the Netty protocol, is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise the...

PT-2026-60396

Name of the Vulnerable Software and Affected Versions Zoom Clients for Windows affected versions not specified Description A time-of-check to time-of-use TOCTOU race condition exists in the installation and uninstallation process. This flaw allows an authenticated local user to escalate privilege...

Vulnerability of the Audio/Video component: The playback feature in browsers Firefox and Firefox ESR, as well as in the email client Thunderbird, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Audio/Video component: The playback functions of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are vulnerable due to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow an attacker to compromise the...

PT-2026-60180

Name of the Vulnerable Software and Affected Versions Cloudreve versions 4.12.0 through 4.16.0 Description OAuth access tokens are issued without the client id claim. Consequently, the JWT JSON Web Token verifier fails to load token scopes into the request context. This causes the RequiredScopes...

SUSE SLES12 Security Update : kernel (Live Patch 71 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:2955-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2955-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.269 fixes various security issues The following security issues were fixed: -...

SUSE-SU-2026:2995-1 Security update for the Linux Kernel (Live Patch 69 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.261 fixes various security issues The following security issues were fixed: - CVE-2026-31685: netfilter: ip6teui64: reject invalid MAC header for all packets bsc1263670. - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on...

JLSEC-2026-708

Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in writing beyond the bounds of an allocated buffer. Note that in wolfSSL, ECH is off by default, and the ECH standard is still evolving...

JLSEC-2026-698 Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding...

Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...

JLSEC-2026-701

In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 wolfSSL 5.8.2 and earlier is...

JLSEC-2026-678 In wolfSSL prior to 5.6.6, if callback functions are enabled (via the `WOLFSSL_CALLBACKS` flag),...

In wolfSSL prior to 5.6.6, if callback functions are enabled via the WOLFSSLCALLBACKS flag, then a malicious TLS client or network attacker can trigger a buffer over-read on the heap of 5 bytes WOLFSSLCALLBACKS is only intended for debugging...

JLSEC-2026-737 TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished...

TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, b...

JLSEC-2026-735 Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain...

Un-negotiated Raw Public Key RFC 7250 accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually negotiated for that peer...

JLSEC-2026-711 Stack Buffer Overflow in `wc_HpkeLabeledExtract` via Oversized ECH Config

Stack Buffer Overflow in wcHpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH Encrypted Client Hello support, where a maliciously crafted ECH config could cause a stack buffer overflow on the client side, leading to potential remote execution and client...

DEBIAN-CVE-2026-49855

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an...

CVE-2026-49855

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an...

UBUNTU-CVE-2026-49853

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme, host, or port...

CVE-2026-48125

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...

DEBIAN-CVE-2026-48125

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...

UBUNTU-CVE-2026-48125

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...

CVE-2026-48125

UAParser.js (versions 2.0.1–2.0.9) is affected by a Regular Expression Denial of Service (ReDoS) when using the Client Hints API. A crafted Sec-CH-UA-Model header passed to UAParser(headers).withClientHints() can cause catastrophic backtracking in the device regex, leading to excessive CPU usage ...