Security Bulletin: IBM Documentation Offline is vulnerable to `Denial of Service via __proto__ header name in req.headersDistinct` due to Node.js (CVE-2026-21710)

Summary IBM Documentation Offline utilizes Node.js as a third-party component, which contains a vulnerability that could potentially affect your product's stability and security. CVE-2026-21710 CVSS: 3.1 is a denial-of-service DoS vulnerability identified in the Node.js core HTTP module. An...

Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163. Patch Instructions: To install this SUSE update use...

BIT-NODE-MIN-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

BIT-NODE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-86656

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

CVE-2026-86351: URL Redirection to Untrusted Site

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-82756: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

PT-2026-86741

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-86926

Improper Encoding or Escaping of Output vulnerability in ash-project ash authentication oauth2 server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resource metadata=".....

Linux Distros Unpatched Vulnerability : CVE-2026-80875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeofstruct ipv6hdr, while t...

Linux Distros Unpatched Vulnerability : CVE-2026-80760

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it...

LOYTEC L-IP BACnet/IP Routers Cross-site Scripting (CVE-2026-12496)

An unauthenticated remote attacker can inject and store malicious JavaScript in the OPC XML-DA server statistics page /webui/statistics/opcsrv of a LOYTEC L-IP BACnet/IP router by sending a crafted 'User-Agent' header in a POST request to the device's '/da' endpoint. The script executes in an...

Exploit for CVE-2026-42559

CVE-2026-42559 — DNS rebinding in the rmcp Streamable HTTP s...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via improper handling of the Set-Cookie header when the Domain attribute matches a public suffix. An attacker can cause cookies to be sent to arbitrary sibling subdomains by setting a cookie with a domain scope tha...

AZL-99825 CVE-2026-82209 affecting package rust 1.75.0-30

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...

ALPINE-CVE-2026-82209

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...

ALPINE-CVE-2026-80255

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

AZL-99810 CVE-2026-80255 affecting package mysql 8.0.46-1

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

AZL-99828 CVE-2026-80255 affecting package rust 1.75.0-31

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

AZL-99864 CVE-2026-80255 affecting package rust 1.90.0-10

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...