CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

DEBIAN-CVE-2026-59903

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...

CVE-2026-59903

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...

UBUNTU-CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-72045

A flaw was found in the Linux kernel component octeontx2-af. A local attacker with access to a Virtual Function VF could exploit an unsanitized input in the rvumboxhandlerlmtsttblsetup function. This vulnerability allows the VF to read the physical base address of another function's LMTLINE, whic...

CVE-2026-56090

creationtimestamp| type| source ---|---|--- 2026-08-17 18:12:23+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtccicql7725 2026-08-17 18:12:33+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117112199069003471...

curl security update

An update is available for curl. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for...

RLSA-2026:55439 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...

CVE-2026-71203

creationtimestamp| type| source ---|---|--- 2026-08-17 18:00:04+00:00| seen| Telegram/hDDilD4Zf9-gI1Gn10sykTtiK4LT5Zn07fv0DMntTOtvA 2026-08-18 00:00:12+00:00| published-proof-of-concept| Telegram/hDDilD4Zf9-gI1Gn10sykTtiK4LT5Zn07fv0DMntTOtvA...

CVE-2026-59903 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...

CVE-2026-59903

Netty's CorsHandler.setVaryHeader uses set() to write the Vary: Origin header, which replaces any application-defined Vary headers (e.g., Authorization, Cookie) rather than appending to them. This causes caching proxies and CDNs to ignore per-user cache keys and serve one user's authenticated res...

CVE-2026-59903

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...

CVE-2026-59903

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...

CVE-2026-59903 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...

CVE-2026-59903 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...

EUVD-2026-60318

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...

GHSA-4H34-V6R8-MMJC Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Summary Glances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Summary Glances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

kernel: drm/amdgpu: zero-initialize GART table on allocation

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. When allocating a Graphics Address Remapping Table GART, the memory was not properly initialized. This could allow a local attacker to potentially access uninitialized memory, leading to information disclosure or unexpected system...

EUVD-2026-60302

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...