[SECURITY] Fedora 45 Update: mod_security-2.9.14-2.fc45

ModSecurity is an open source intrusion detection and prevention engine for web applications. It operates embedded into the web server, acting as a powerful umbrella - shielding web applications from attacks...

EUVD-2026-91849

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...

CVE-2026-104433

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...

CVE-2026-104433: Out-of-bounds Read

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...

CVE-2026-104433 Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...

CVE-2026-104433 Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...

CVE-2026-104433 Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...

CVE-2026-104433

The Mooncake transfer engine (versions before 0.3.12 ) is vulnerable to an out-of-bounds read in the readString function located in include/common.h. This flaw allows unauthenticated attackers to crash the service, such as an SGLang inference server , by connecting to the handshake port listening...

p2pstore (>=0.1.7.dev1, <=0.1.13) potentially affected by CVE-2026-104433 via mooncake-transfer-engine (0.3.7)

mooncake-transfer-engine PYPI version 0.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on mooncake-transfer-engine and may be impacted: - p2pstore =0.1.7.dev1, =0.1.13 Source cves: CVE-2026-104433 Source advisory: MEND:CVE-2026-104433...

avwx-engine (>=1.2.5, <=1.4.6), azely (>=0.4.0, <=0.6.0) +2 more potentially affected by CVE-2026-77387 via geopy (1.23.0)

geopy PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on geopy and may be impacted: - avwx-engine =1.2.5, =0.4.0, =0.2.4, =0.2.4, =0.2.8 Source cves: CVE-2026-77387 Source advisory: OSV:GHSA-MHVH-FQ92-PFMR...

CVE-2026-95284

A buffer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556435507...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-104054

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely...

EUVD-2026-91160

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely...

CVE-2026-104054 calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely...

CVE-2026-104054 calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely...

CVE-2026-104054 calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely...

CVE-2026-104054

A security flaw in calcom cal.diy up to version 6.2.0 allows for missing authorization due to a vulnerability in the PBAC Permission Engine component. Specifically, the doesUserIdHaveAccessToBooking function within the BookingAccessService.ts file can be manipulated to bypass intended access cont...

EUVD-2026-91134

Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single...

EUVD-2026-91136

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...