CVE-2026-102727

FTP Passive Data Connection Not Bound to the Authenticated Control Peer...

EUVD-2026-89199

FTP Passive Data Connection Not Bound to the Authenticated Control Peer...

CVE-2026-102727

Technical details are not publicly available in the provided documents regarding CVE-2026-102727 . The description indicates an FTP Passive Data Connection Not Bound to the Authenticated Control Peer , but no specific product, version, or root cause is provided. Action: monitor for updates.

CVE-2026-102727

FTP Passive Data Connection Not Bound to the Authenticated Control Peer...

CVE-2026-102727

FTP Passive Data Connection Not Bound to the Authenticated Control Peer...

CVE-2026-102727

FTP Passive Data Connection Not Bound to the Authenticated Control Peer...

CVE-2026-84784

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by flooding a connection with connection identifier update requests while withholding acknowledgments. This behavior bypasses connection limits and forces the system to accumulate pending retirement frames, resulting...

OPENSUSE-SU-2026:22003-1 Security update for python-pymongo

This update for python-pymongo fixes the following issues: Changes in python-pymongo: - CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside the bounds of an allocated buffer bsc1282845 - CVE-2026-96748: host injection in connection string leadin...

SUSE-SU-2026:4398-1 Security update for python-pymongo

This update for python-pymongo fixes the following issues: - CVE-2026-96747: improper handling of key management endpoint values ending in .sock allows users with write access to the encryption key metadata to open connections to local sockets on the application host bsc1282844. - CVE-2026-96748:...

AZL-105458 CVE-2026-75804 affecting package cloud-hypervisor 52.0.152-1

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-93332

An improper access control vulnerability exists in the partial connection API of Devolutions Server version 2026.3.5.0 and earlier . An authenticated low-privileged user can exploit this by sending a crafted API request to perform unauthorized actions, including reading, creating, modifying, and ...

EUVD-2026-88999

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-93332

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

CVE-2026-97409

A flaw was found in the Linux kernel's NVMe over Fibre Channel NVMe-FC driver. When establishing a connection to an NVMe-FC target, an administrative request timeout triggers error-handling routines that attempt to abort requests on uninitialized I/O queues. A malicious or unresponsive target cou...

CVE-2026-86843

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

CVE-2026-86843 Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

CVE-2026-98070

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS subsystem. Due to improper synchronization during TCP connection path resets, transmit operations can run concurrently while connection state is being modified. An attacker could exploit this timing window during connection...

CLEANSTART-2026-SO94492 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

CVE-2026-64607 affects multiple packages. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. See references for individual...

PT-2026-102660

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A malicious remote peer can flood the local QUIC stack with NEW CONNECTION ID frames by bypassing the limit check on the number of connection IDs the remote stack can use. The local stack...