PT-2026-85292

Name of the Vulnerable Software and Affected Versions core-moos versions prior to 10.4.1 Description A denial of service issue exists in the MOOSCommServer::ListenLoop function. The accept thread performs a blocking receive without a timeout during the wire-protocol handshake. An attacker can...

PT-2026-85071

Name of the Vulnerable Software and Affected Versions MongoDB extension for Visual Studio Code affected versions not specified Description A component of the MongoDB extension for Visual Studio Code fails to neutralize special characters within a connection string before incorporating that value...

Curl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse

The version of curl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is...

Linux Distros Unpatched Vulnerability : CVE-2026-84372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster an...

After Veeam ONE 13.1.0.7034 Upgrade: No connection could be made because the target machine actively refused it. (localhost:2743)

Article Applicability The issue described in this article only occurs for deployments in which Veeam ONE was installed to a folder other than the default C:\Program Files\Veeam\Veeam ONE\ path. Challenge After Veeam ONE is upgraded to version 13.1 build 13.1.0.7034, reports cannot be generated an...

CVE-2026-55857

A flaw was found in MariaDB Connector/J. A remote attacker or a man-in-the-middle server can exploit a vulnerability in the PAM dialog authentication mechanism. This flaw allows the attacker to coerce the connector into transmitting account passwords over an insecure connection when default...

CVE-2026-78662

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99207 CVE-2026-78662 affecting package docker-compose for versions less than 2.27.0-14

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99249 CVE-2026-78662 affecting package kubernetes for versions less than 1.30.10-30

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

CVE-2026-56855

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99255 CVE-2026-56855 affecting package kubernetes for versions less than 1.30.10-30

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99381 CVE-2026-56855 affecting package telegraf for versions less than 1.31.0-33

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99135 CVE-2026-56855 affecting package cri-o 1.30.1-1

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-99159 CVE-2026-56855 affecting package cert-manager for versions less than 1.12.15-14

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

CVE-2026-78662 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

CVE-2026-78662

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

GO-2026-6355 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

Allocation of Resources Without Limits or Throttling

Overview github.com/golang/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its connection multiplexing, reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, which buffers...

CVE-2026-84380

A flaw was found in HTTPX2, a Python HTTP client. The Request.prepare function can incorrectly add a Content-Length header to a request that already includes a Transfer-Encoding header. This conflict in HTTP framing headers can lead to request smuggling or connection desynchronization. This could...

CVE-2026-84380

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...