PT-2026-137238

A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smbcheckpermdacl and...

CLEANSTART-2026-EX69049 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

Linux Distros Unpatched Vulnerability : CVE-2026-107279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering...

CLEANSTART-2026-BH99194 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

CLEANSTART-2026-DQ92656 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

CLEANSTART-2026-FR59330 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

CVE-2026-104016

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...

low-int-cert-monitor

low-int-cert-monitor Detect X.509 certificates whose elliptic-curve private key is a trivially small integer public point Q = dG for small d — the eMudhra misissuance class. Curves: P-256, P-384, P-521. Layout p4mon/ — production monitor: in-memory Rust checker, CT-log tailer, systemd units commo...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INTMIN The BPF interpreter’s signed 32-bit division and modulo handlers use the kernel abs macro on s32 operands. The abs macro documentation include/linux/math.h explicitl...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: Fix integer overflow in ghesestatuspoolinit Change numghes from int to unsigned int, preventing an overflow and causing subsequent vmalloc to fail. The overflow occurs in ghesestatuspoolinit when calculating len durin...

CLEANSTART-2026-SG10675 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

CVE-2026-107279

A flaw was found in AsyncHttpClient. A remote attacker can bypass mutual authentication by offering HTTP Digest authentication configured with integrity protection auth-int. Because the client fails to validate the response authentication value under this configuration and treats the unverified...

CLEANSTART-2026-AF62012 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

UBUNTU-CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

Incorrect Implementation of Authentication Algorithm

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm in the AuthenticatorUtils.computeExpectedRspAuth process. An attacker can impersonate a...

EUVD-2026-94638

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

CVE-2026-107279

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...