ROS-20261009-73-0413

The vulnerability of the hfsplus component in the Linux operating system’s kernel is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

MAL-2026-17723 Malicious code in @galicia-toolkit-nestjs/paas (npm)

@galicia-toolkit-nestjs/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim...

Elasticsearch 7.17.5 / 17.17.29 / 8.2.2 < 8.19.19 / 9.x < 9.3.8 / 9.4.x < 9.4.4 Incorrect Authorization (ESA-2026-188)

The version of Elasticsearch installed on the remote host is prior to 8.19.19, 9.3.8, 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-188 advisory. - Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing...

ROS-20261009-73-0139

The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

@galicia-toolkit-nestjs-20-lite/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beac...

PT-2026-108769

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf component where an LWT SEG6LOCAL program can invalidate its cached Segment Routing Header SRH using the bpf lwt seg6 adjust srh function and subsequently call...

HAProxy drl field Data Compromise

The vulnerability of the drl field in the fcgiconn structure of the HAProxy server software is related to integer overflow. Exploiting this vulnerability can allow an attacker to compromise the integrity and accessibility of the protected information...

openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory. - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. - CVE-2026-37236:...

Aiohttp HTTP client Host Certificate DOSS

The vulnerability of the Aiohttp HTTP client is related to the lack of checking host certificate data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

HTTP/3 Server Data Compromise

The vulnerability of HTTP/3 server-side software such as HAProxy is related to errors in processing input data length parameters. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information...

Aiohttp HTTP Client Unauthorized Access

The vulnerability of the Aiohttp HTTP client is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Aiohttp HTTP Client Source Verification Confidential Data Access

The vulnerability of the Aiohttp HTTP client is related to a lack of mechanisms for verifying the source of the connection. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...

AZL-107258 CVE-2026-97032 affecting package containerized-data-importer 1.62.0-8

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107252 CVE-2026-78669 affecting package containerized-data-importer 1.62.0-8

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107249 CVE-2026-78660 affecting package containerized-data-importer 1.62.0-8

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107264 CVE-2026-78663 affecting package containerized-data-importer 1.62.0-8

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107255 CVE-2026-78659 affecting package containerized-data-importer 1.62.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service.

Summary minimatch is used by IBM Storage Fusion Data Foundation, which could cause a Denial of Service. CVE-2026-26996. Vulnerability Details CVEID:CVE-2026-26996 DESCRIPTION: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 a...

CVE-2026-21589: Critical Pre-Authentication File Read Affects Atlassian Data Center Products

Atlassian has released an out-of-band security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting a broad range of its Data Center products. The flaw carries a CVSS 4.0 score of 9.3 and can be exploited remotely without authentication or user interaction. Becaus...

Security Bulletin: IBM Fusion Data Foundation is vulnerable to Denial of Service.

Summary brace-expansion is used by IBM Fusion Data Foundation, which could cause a Denial of Service. CVE-2026-45149. Vulnerability Details CVEID:CVE-2026-45149 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6,...