ai.covia:covia-claude-code (>=0.9.3, <=0.9.8), ai.covia:covia-discord (>=0.9.4, <=0.9.8) +101 more potentially affected by CVE-2026-111763 via org.a2aproject.sdk:a2a-java-sdk-client-transport-spi (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-client-transport-spi MAVEN version =1.0.0.alpha4, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.1.0, =0.2.1.2-alpha, =0.6.0, =0.1.0, =0.1.0, =0.1.1, =0.1.2 and more Source cves: CVE-2026-111763 Source advisory: MEND:CVE-2026-111763...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.8), ai.covia:covia-discord (>=0.9.4, <=0.9.8) +109 more potentially affected by CVE-2026-111763 via org.a2aproject.sdk:a2a-java-sdk-http-client (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-http-client MAVEN version =1.0.0.alpha4, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.1.0, =0.2.1.2-alpha, =0.6.0, =0.1.0, =0.1.0, =0.1.1, =0.1.2 and more Source cves: CVE-2026-111763 Source advisory: MEND:CVE-2026-111763...

org.a2aproject.sdk:a2a-java-sdk-compat-0.3-client (>=1.0.0.cr1, <=1.2.0.final), org.a2aproject.sdk:a2a-java-sdk-compat-0.3-client-transport-grpc (>=1.0.0.cr1, <=1.2.0.final) +4 more potentially affected by CVE-2026-111763 via org.a2aproject.sdk:a2a-java-sdk-compat-0.3-client-transport-spi (>=1.0.0.cr1, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-compat-0.3-client-transport-spi MAVEN version =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.final, =1.1.0.final - org.wildfly.a2a:a2a-jakarta-itk 1.0.0.cr2 Source cves: CVE-2026-111763 Source advisory: MEND:CVE-2026-111763...

CVE-2026-92287

A flaw was found in Apache Arrow and PyArrow. When reading encrypted Parquet files configured with a Key Management Service KMS client, unvalidated KMS server addresses embedded within the file can be passed directly to the client implementation. An attacker can supply a maliciously crafted Parqu...

ROOT-APP-GOBINARY-CVE-2026-73500 CVE-2026-73500 in go.etcd.io/etcd/client/pkg/v3 - Patched by Root

Root has patched CVE-2026-73500 in the go.etcd.io/etcd/client/pkg/v3 package for Root:Go. Multiple fixed versions available...

BIT-DISTRIBUTION-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

CLEANSTART-2026-DX01357 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...

CVE-2026-85024 affects multiple packages. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. See references for individual vulnerability details...

CLEANSTART-2026-IH07512 undici's WebSocket client crashes the whole Node

Security vulnerability affects the renovate package. undici's WebSocket client crashes the whole Node...

CLEANSTART-2026-FL50356 It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak

Security vulnerability affects the keycloak package. It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2026-53995 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2026-53995 Source advisory: OSV:GHSA-WQMH-QCCW-PQWF...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2026-53995 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2026-53995 Source advisory: OSV:GHSA-WQMH-QCCW-PQWF...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2026-53995 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2026-53995 Source advisory: OSV:GHSA-WQMH-QCCW-PQWF...

curl: TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another

Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/vtls/vtlsscache.c Affected: curl 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295, wrong client identity on a resumed TLS session. Same class ...

Oracle MySQL Vulnerability CVE-2026-101770

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Client programs. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit...

SUSE SLES15: kubernetes1.37-client / kubernetes1.37-client-bash-completion / etc (SUSE-SU-2026:4740-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4740-1 advisory. This update for kubernetes rebuilds it against the current go security release. Tenable has extracted the preceding description block direct...

PT-2026-120041

Vulnerability in Oracle GoldenGate component: Admin Client Executable. Supported versions that are affected are 23.4-23.26.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerabili...

Oracle MySQL Vulnerability CVE-2026-101754

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Client programs. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit...

PT-2026-119389

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description An issue exists in the Web Client component of the Oracle Agile PLM product within Oracle Supply Chain. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain...