CLEANSTART-2026-SE65887 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

CLEANSTART-2026-FR89285 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

EUVD-2026-107633

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on...

RLSA-2026:87080 Important: php:7.4 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Out-of-bounds read via empty HTTP redirect Location header CVE-2026-93682 php: PHP: Archive entry injection via integer overflow in TAR parser CVE-2026-6103 php: PHP: Denial of Service...

SUSE SLED15: openssh / openssh-askpass-gnome / openssh-clients / openssh-common / etc (SUSE-SU-2026:4827-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4827-1 advisory. - CVE-2026-73281: refused binding requests on locked SSH agents can allow destination restriction bypasses...

Linux Distros Unpatched Vulnerability : CVE-2026-114729

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcubewashtml inspected the SVG SMIL animation attributes...

Linux Distros Unpatched Vulnerability : CVE-2026-114044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by...

SUSE SLES15: openssh / openssh-askpass-gnome / openssh-clients / openssh-common / etc (SUSE-SU-2026:4811-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4811-1 advisory. - CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after- free bsc1275074. -...

CVE-2026-100420

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on...

CVE-2026-100420

A sensitive information disclosure vulnerability exists in the cloud-client daemon of the Deco BE63 . This flaw allows authenticated attackers to retrieve the plaintext TP-Link ID account password . Successful exploitation could lead to the compromise of the associated cloud account, enabling att...

DEBIAN-CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

EUVD-2026-105148

Vitest: Code injection via unauthenticated manual mock registration...

EUVD-2026-107499

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-105933

In Apache Pulsar , a vulnerability exists where the encryption_required namespace policy is not enforced if a failure occurs during topic initialization (e.g., errors reading from the metadata store). Instead of failing the load, the broker logs a warning and proceeds by disabling the encryption ...

CVE-2026-105933 Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryptionrequired namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, it...

CVE-2026-76462

A vulnerability in the interprocess communication IPC channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...

CVE-2026-76462 Cisco Secure Client Privilege Escalation Vulnerability

A vulnerability in the interprocess communication IPC channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...

EUVD-2026-107381

A vulnerability in the interprocess communication IPC channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An...