USN-8177-1 linux, linux-realtime vulnerabilities

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcod...

Static resource cache poisoning in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, the attacker can send malicious requests and poison the resource cache wi...

Denial of service in static resource handling on Windows platforms

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, the attacker can send malicious requests that are slow to resol...

Oracle Linux 9 : .NET / 10.0 (ELSA-2026-8471)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-8471 advisory. 10.0.106-1.0.1 - Add support for Oracle Linux 10.0.106-1 - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163384 Tenable has extracted...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007367)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007367 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: qcom: ipq8074: dont disable gccsleepclksrc Once the usb sleep clocks are disabled, clock...

[SECURITY] Fedora 44 Update: spacebar-6.6.4-1.fc44

Spacebar is a telepathy-qt based SMS application that primarily targets Plasm a Mobile...

[SECURITY] Fedora 44 Update: layer-shell-qt-6.6.4-1.fc44

This component is meant for applications to be able to easily use clients based on wlr-layer-shell...

[SECURITY] Fedora 44 Update: kf6-solid-6.25.0-1.fc44

Solid provides the following features for application developers: - Hardware Discovery - Power Management - Network Management...

[SECURITY] Fedora 44 Update: kf6-kfilemetadata-6.25.0-1.fc44

A Tier 2 KDE Framework for extracting file metadata...

[SECURITY] Fedora 44 Update: kf6-kcmutils-6.25.0-1.fc44

KCMUtils provides various classes to work with KCModules. KCModules can be created with the KConfigWidgets framework...

[SECURITY] Fedora 44 Update: kf6-kcalendarcore-6.25.0-1.fc44

KDE Frameworks 6 Tier 1 KCalendarCore Library...

[SECURITY] Fedora 44 Update: kf6-frameworkintegration-6.25.0-1.fc44

Framework Integration is a set of plugins responsible for better integration of Qt applications when running on a KDE Plasma workspace. Applications do not need to link to this directly...

carton-mcp (>=0.1.80, <=0.1.83), heaven-framework (>=0.1.24, <=0.1.36) +2 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.22)

langchain-openai PYPI version 0.3.22 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - carton-mcp =0.1.80, =0.1.24, =0.1.0, =0.0.4, =0.0.6 Source cves: CVE-2026-41488 Source advisory: OSV:GHSA-R7W7-9XR2-QQ2R...

CVE-2026-40255

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect.back method reads the Referer header from the incoming HTTP...

CVE-2026-39313

mcp-framework is a framework for building Model Context Protocol MCP servers. In versions 0.2.21 and below, the readRequestBody function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never...

CVE-2026-39313

mcp-framework is a framework for building Model Context Protocol MCP servers. In versions 0.2.21 and below, the readRequestBody function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never...

CVE-2026-39313 MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

mcp-framework is a framework for building Model Context Protocol MCP servers. In versions 0.2.21 and below, the readRequestBody function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never...

CVE-2026-39313

mcp-framework is a framework for building Model Context Protocol MCP servers. In versions 0.2.21 and below, the readRequestBody function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never...

@aumoai/mcp-data-analyst (>=0.1.0, <=0.2.8), @geobio/code_execution_server (>=0.2.0, <=0.2.1) +35 more potentially affected by CVE-2026-39313 via mcp-framework (>=0.1.27, <=0.2.15)

mcp-framework NPM version =0.1.27, =0.1.0, =0.2.0, =1.0.11, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves: CVE-2026-39313 Source advisory: MEND:CVE-2026-39313...

Allocation of Resources Without Limits or Throttling

Overview mcp-framework is a Framework for building Model Context Protocol MCP servers in Typescript Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the readRequestBody function. An attacker can exhaust system memory and cause a server...