EUVD-2026-86335

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-61815

The zbateson/mail-mime-parser library is vulnerable to CRLF header injection (CWE-93) in versions prior to 3.0.6 and 4.0.2 . The root cause is the interpolation of attacker-influenced attachment filenames into Content-Type and Content-Disposition headers without stripping CR/LF characters. This a...

CVE-2026-61815

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF carriage-return / line-feed header injection CWE-93 affecting any application that uses this libra...

CVE-2026-71540 Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before...

CVE-2026-71540 Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before...

CVE-2026-71540 Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before...

CVE-2026-71540

The Wazuh security platform is vulnerable to a memory exhaustion issue in versions 3.9.0 through 4.14.7 . The flaw exists in the wazuh-clusterd component (specifically in framework/wazuh/core/cluster/common.py), where the system allocates a payload buffer based on a 20-byte cluster protocol heade...

SUSE CVE-2026-67235

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against maxmessagesize. The size check ran only when assembly completed. By declaring bodysize = 2^63-1 and then streaming...

SUSE CVE-2026-67405

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...

SUSE CVE-2026-86350

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

DEBIAN-CVE-2026-97404

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in...

CVE-2026-97404

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in...

CVE-2026-81549

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header...

EUVD-2026-85915

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in...

CVE-2026-97404

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in...

CVE-2026-97404

In OpenStack Zaqar versions before 22.0.2 , the WSGI transport mishandles the URL-Signature header . An unauthenticated remote attacker who knows a target project's UUID can bypass Keystone authentication and pre-signed URL verification by sending a request with an empty URL-Signature header. Thi...

CVE-2026-97404

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in...

EUVD-2026-85911

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header...

CVE-2026-81549 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header...