Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...

SUSE SLED15 / SLES15 Security Update : httpcomponents-client (SUSE-SU-2026:4028-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4028-1 advisory. This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying...

RHEL 9 : curl (RHSA-2026:69126)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69126 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

RHEL 10 : curl (RHSA-2026:69125)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69125 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

OPENSUSE-SU-2026:21894-1 Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163...

OPENSUSE-SU-2026:21888-1 Security update for gnome-remote-desktop

This update for gnome-remote-desktop fixes the following issue: - CVE-2026-18358: system-mode RDP server missing connection throttling can allow unauthenticated denial of service bsc1273354...

Fedora 43 : opkssh (2026-38b019a0f0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-38b019a0f0 advisory. Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 denial of service via crafted channel messages in...

Fedora 44 : opkssh (2026-f7b73f165d)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f7b73f165d advisory. Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 denial of service via crafted channel messages in...

CVE-2026-82672

CVE-2026-82672 is an HTTP Request/Response Smuggling vulnerability in the Elixir mint HTTP/1 client library (versions 0.1.0 through before 1.10.1). The root cause lies in Mint.HTTP1.Parse.chunk_size/1, which stops parsing a chunked response's chunk-size line at the first non-hexadecimal byte and ...

EEF-CVE-2026-82672 Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent request...

SUSE CVE-2026-86862

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

SUSE CVE-2026-86864

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with ...

EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3717)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3764)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-3687)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS...

CVE-2026-92757

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

Security Bulletin: Vulnerable Version of Software in Use

Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of curl. Vulnerability Details CVEID:CVE-2026-1965 DESCRIPTION: libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757

MongoDB Entity Framework Core Provider is affected by a vulnerability where placing a database name in the connection string may inadvertently disable field-level encryption , leaving sensitive data unprotected. The root cause is a malformed connection string interpretation by the provider. The i...