CVE-2026-10097

wolfSSL's AVX2-optimized ML-KEM implementation mlkemcmpavx2 compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check in ML-KEM-1024 decapsulation. Ciphertexts that differ from the expected re-encryption solely in bytes 1536-1567 bypass implicit rejection and...

Off-by-one Error

Overview Affected versions of this package are vulnerable to Off-by-one Error in the decodessr3 function when processing crafted RTCM3 SSR messages containing attacker-controlled signal mode fields. An attacker can cause a buffer overflow and potentially crash the application or disrupt service b...

CVE-2026-28898

swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values :path, :authority, :scheme, :method, and :status at both the HPACK...

netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

GO-2026-5265 OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages in go.opentelemetry.io/obi

OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages in go.opentelemetry.io/obi...

CVE-2026-28898

swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values :path, :authority, :scheme, :method, and :status at both the HPACK...

CVE-2026-28898

The swift-nio-http2 library is vulnerable to HTTP/2-to-HTTP/1.1 request smuggling because the HTTP2FramePayloadToHTTP1ServerCodec and HTTP2ToHTTP1ServerCodec components fail to validate pseudo-header values for control characters. A remote attacker can inject CR () , LF () , or NUL () bytes into ...

GO-2026-5138 Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information in github.com/free5gc/udm

Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information in github.com/free5gc/udm...

GO-2026-5174 Velocidex Velociraptor has an off-by-one error in www.velocidex.com/golang/velociraptor

Velocidex Velociraptor has an off-by-one error in www.velocidex.com/golang/velociraptor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the RealIP process. An attacker can cause misidentification of the request source IP by manipulating the X-Forwarded-For header, potentially bypassing access controls or falsifying request logs. Remediation...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the RealIP process. An attacker can cause misidentification of the request source IP by manipulating the X-Forwarded-For header, potentially bypassing access controls or falsifying request logs. Remediation...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the RealIP process. An attacker can cause misidentification of the request source IP by manipulating the X-Forwarded-For header, potentially bypassing access controls or falsifying request logs. Remediation...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the RealIP process. An attacker can cause misidentification of the request source IP by manipulating the X-Forwarded-For header, potentially bypassing access controls or falsifying request logs. Remediation...

CVE-2026-53058

A flaw was found in the drm/bridge: cadence: cdns-mhdp8546-core component of the Linux kernel. This vulnerability allows for a NULL pointer dereference during error handling within the atomicenable function. If cdnsmhdplinkup or cdnsmhdpregread encounter errors, a subsequent attempt to access a...

MAL-2026-6468 Malicious code in ts-opus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b0105b34723dd6e1449c3353d1d4df0dcf94ae460a4dfd156566bb4ba372c7 ts-opus 0.0.8 ships an unmodified copy of MikeMcl/big.js README, copyright, and repository URL all reference big.js but injects an additional top-lev...

Malicious code in ts-opus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b0105b34723dd6e1449c3353d1d4df0dcf94ae460a4dfd156566bb4ba372c7 ts-opus 0.0.8 ships an unmodified copy of MikeMcl/big.js README, copyright, and repository URL all reference big.js but injects an additional top-lev...

CVE-2026-53066

A flaw was found in the Linux kernel's drm/sun4i backend component. This vulnerability occurs because the drmatomicgetplanestate function can return an error pointer, which is not properly checked before being dereferenced. An attacker could potentially trigger this unchecked dereference, leading...

netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...