Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS mutual Transport Layer Security setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive informati...

CVE-2026-64067

A flaw was found in the Linux kernel's netfs component. This vulnerability stems from missing memory barriers when the stream-subrequests list is accessed without locks. Specifically, functions that process read and write results, such as netfscollectreadresults and netfscollectwriteresults, acce...

RHEL 8 : nodejs:22 (RHSA-2026:41947)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41947 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

CVE-2026-53368

CVE-2026-53368 concerns the Linux kernel f2fs filesystem. Multiple sources describe a fix for fsck inconsistency caused by incorrect nat_entry flag handling during checkpoint sequencing. The root cause is that f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpo...

PT-2026-61070

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An inconsistency in the f2fs file system occurs during fsck operations due to the incorrect usage of nat entry flags. The function f2fs need dentry mark reads these flags without mutual...

CVE-2026-60082 DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent...

The vulnerability of the DTLS implementation of the GnuTLS cryptographic library allows a attacker to induce a service failure.

The vulnerability of the DTLS protocol implementation of the GnuTLS cryptographic library is related to unpredictable behavior of functions due to inconsistencies in parameter values. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

UBUNTU-CVE-2026-53303

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extensionlist reading with sblock in f2fssbishow In f2fssbishow, the extensionlist, extensioncount and hotextcount are read without holding sbi-sblock. If a concurrent sysfs store modifies the extension list via...

CVE-2026-53303

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extensionlist reading with sblock in f2fssbishow In f2fssbishow, the extensionlist, extensioncount and hotextcount are read without holding sbi-sblock. If a concurrent sysfs store modifies the extension list via...

PT-2026-52942

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the f2fs module, the f2fs sbi show function reads extension list, extension count, and hot ext count without holding the sb lock. If a concurrent sysfs store operation modifies the...

GO-2026-5547 in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang

in-toto-golang and in-toto-python have inconsistent negation behavior in github.com/in-toto/in-toto-golang...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “net/mlx5: Block entering switchdev mode with ns inconsistency” has been reverted. This reversion is associated with the commit 662404b24a4c4d839839ed25e3097571f5938b9b. The reversion is necessary due to concerns that this issue...

Improper Handling of Length Parameter Inconsistency

Overview zeroconf is a Pure Python Multicast DNS Service Discovery Library Bonjour/Avahi compatible Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via the readcharacterstring and readstring functions. An attacker can inject malicious...

CVE-2026-53655

node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar node-tar applies a PAX extended header's size= record and other PAX overrides to the next header entry of any type, including intermediary metadata headers such as a GNU long-name L or long-link K entry. Per POSIX pax, a PAX extend...

Astra Linux – Vulnerability in Linux

A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through version 5.9.13. Files drivers/tty/ttyio.c and drivers/tty/ttyjobctrl.c may allow a read-after-free attack on TIOCGSID, also known as CID-c8bcd9c5be24...

undertow: Undertow: Request smuggling via inconsistent header parsing

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks,...

Unveiling Privacy Risks in Multi-Modal Large Language Models: Task-Specific Vulnerabilities and Mitigation Challenges

Privacy risks in text-only Large Language Models LLMs are well studied, particularly their tendency to memorize and leak sensitive information. However, Multi-modal Large Language Models MLLMs, which process both text and images, introduce unique privacy challenges that remain underexplored...

CVE-2026-8874

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS...

CVE-2026-8874

CVE-2026-8874 affects Securly Chrome Extension v3.0.7. It fetches crisis alert keywords and filtering rules over HTTP, while other endpoints use HTTPS, showing TLS inconsistency. This could allow network interception/modification of downloaded configuration data. Reported impact: confidentiality/...

CVE-2026-8874 CVE-2026-8874

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS...