BIT-POSTGRESQL-2026-6479 PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AFUNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18....

[SECURITY] Fedora 44 Update: libmetal-2026.04.0-2.fc44

An abstraction layer across user-space Linux, baremetal, and RTOS environment s...

CVE-2026-8775 Edimax BR-6428NS POST Request formL2TPSetup buffer overflow

A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has...

PT-2026-41787

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions prior to 0.9.0 Description A memory leak exists in the custom CappedConcurrentHashMap used for Java TLS state tracking. The remove function deletes entries from the map but fails to remove the...

Wireshark DoS

The vulnerability of the TLS protocol analyzer and the network traffic analyzer in Wireshark relates to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability can allow a attacker to cause a service failure...

RLSA-2026:17075 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: golang: internal/syscall/unix: Root.Chmod can...

RUSTSEC-2026-0148 OCI layer symlink escape → arbitrary host write

Affected versions of boxlite extract OCI image layer tarballs without fully containing path resolution to the extraction root. A crafted layer containing a symlink whose target is an absolute on-host path e.g. escape - /tmp followed by a file entry that resolves through that symlink e.g...

PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

...

Denial Of Service

github.com/hashicorp/boundary is vulnerable to denial of service. The vulnerability is due to improper handling of TLS handshakes during worker node enrollment, where an attacker can delay or withhold the client certificate to block connection handling, allowing legitimate worker connections to b...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-1700)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1700 advisory. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the Go compiler cmd/compile. As a result, the compiler would allow for invalid indexing to...

Symlink Attack

Overview boxlite is a Python bindings for Boxlite runtime Affected versions of this package are vulnerable to Symlink Attack via improper path resolution during extraction of OCI image layer tarballs. An attacker can write arbitrary files to locations outside the intended extraction root by...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via improper path resolution during extraction of OCI image layer tarballs. An attacker can write arbitrary files to locations outside the intended extraction root by crafting a layer with a symlink pointing to an absolut...

Symlink Attack

Overview @boxlite-ai/boxlite is a BoxLite - Embeddable micro-VM runtime for secure, isolated code execution Affected versions of this package are vulnerable to Symlink Attack via improper path resolution during extraction of OCI image layer tarballs. An attacker can write arbitrary files to...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the discovery document retrieval process via uripukidpenc and uripukidpsig properties. An attacker can intercept and modify the TLS connection to substitute a forged discovery document...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the discovery document retrieval process via uripukidpenc and uripukidpsig properties. An attacker can intercept and modify the TLS connection to substitute a forged discovery document...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2026-2652 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2026-2652 Source advisory: OSV:GHSA-75CM-X2W3-8MGF...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2026-2652 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2026-2652 Source advisory: OSV:GHSA-75CM-X2W3-8MGF...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2026-2652 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2026-2652 Source advisory: OSV:GHSA-75CM-X2W3-8MGF...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2026-2652 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2026-2652 Source advisory: OSV:PYSEC-2026-2221...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2026-2652 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2026-2652 Source advisory: OSV:PYSEC-2026-2221...