CVE-2026-43678

A flaw was found in swift-nio. An unauthenticated remote attacker can crash any NIOWebSocket-based server by sending a single 11-byte frame after a completed WebSocket handshake. This vulnerability leads to a Denial of Service DoS, dropping all active connections until the server process restarts...

CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-53572

KEDA (Kubernetes-based Event Driven Autoscaling) is affected by a PostgreSQL connection string parameter injection in pkg/scalers/postgresql_scaler.go prior to version 2.20.0 . The root cause is that escapePostgreConnectionParameter() only quotes values containing a literal space, leaving tabs, n...

CVE-2026-58254

A flaw was found in NATS Server. Message trace destination checks, which ensure that trace events are sent to authorized subjects, were not consistently applied to messages originating from leafnode connections. This inconsistency allows a leafnode operator to bypass these checks and send trace...

CVE-2026-70462

A flaw was found in rsync. A remote attacker can exploit a signed integer overflow vulnerability in the I/O timeout implementation by sending specially crafted messages. These messages can disable connection timeouts, causing idle or stalled connections to persist indefinitely. This leads to...

CVE-2026-59654

Apache CloudStack is affected by a resource leak in its scoped global configuration functionality, where database connections are not properly released after their effective lifetime. The issue impacts multiple management server modules, including Quota and Host-HA , and can lead to an eventual d...

CVE-2026-74530

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, occurs when a connection is prematurely released while a related synchronization task in hciconnectbigsync is still running. This theoretical flaw could allow an attacker to cause a system crash...

curl security, bug fix, and enhancement update

An update is available for curl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...

CVE-2026-74836 HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin an unbounded number of HTTP/2 stream processes indefinitely via connection-level flow control. When a stream's response body outruns the HTTP/2 connection-level se...

curl: curl: Insecure connection establishment due to TLS configuration mismatch

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security TLS configuration of the new transfer does not match the existing connection,...

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements:...

CVE-2026-76361

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

CVE-2026-68552

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr in src/client/nsturnmsg.c to...

EUVD-2026-62855

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

CVE-2026-53549

An authenticated low-privileged user can exploit the unvalidated POST /host/db/proxy/test endpoint to probe internal hosts, metadata services, and cloud credentials; fixed in Termix 2.3.2. No exploitation evidence provided in the documents.

CVE-2026-72491

A flaw was found in the Linux kernel's net/9p RDMA transport module. An inconsistent locking mechanism around the rdma-state field allows for a race condition during connection teardown. This can lead to lost state transitions, corrupting the connection state machine. Consequently, a use-after-fr...

USN-8651-1 curl vulnerability

It was discovered that curl incorrectly handled reusing connections when the origin changed between transfers. A remote attacker could possibly use this issue to obtain sensitive information...

USN-8651-1: curl vulnerability

It was discovered that curl incorrectly handled reusing connections when the origin changed between transfers. A remote attacker could possibly use this issue to obtain sensitive information...

Scammers are using fake crypto AML checkers to drain your wallet

Scammers are creating fake crypto wallet-checking sites that promise to tell you whether a wallet is linked to suspicious activity. Instead, they try to trick you into giving them access to your crypto. What real AML checking looks like AML stands for anti-money laundering. These are rules that...

CVE-2026-11751

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...