CVE-2026-44452

CVE-2026-44452 affects the h2o HTTP server (supports HTTP/1.x, 2, 3). Affected behavior occurs when a TLS/QUIC ClientHello contains a zero-length SNI extension; h2o can attempt to copy the hostname assuming NULL-termination, causing a heap/segmentation fault that may enable a denial-of-service. T...

Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant can create EnvoyExtensionPolicy baseline - Controller has egress to attacker-controlled OCI registry - No registry allowlist none exists in code - Layer presents Docker/OCI...

GHSA-H7PQ-86H8-RP5X Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant can create EnvoyExtensionPolicy baseline - Controller has egress to attacker-controlled OCI registry - No registry allowlist none exists in code - Layer presents Docker/OCI...

MAL-2026-10712 Malicious code in @hibachi-xyz/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d10da07b92571b7e043b1d5a8735143f7abac8e7759ae96b9f815052f01bf5 On require, index.js enumerates process.env and filters keys matching credential-shaped patterns KEY, SECRET, TOKEN, PASS, PRIV, SIGN, AWS, CIRCLE,...

EUVD-2026-44950

Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields such...

CVE-2026-63085 Axelor Open Platform 8.x < 8.2.2 Authorization Bypass via Nested Relational Record Persistence

Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields such...

CVE-2026-63085

Axelor Open Platform 8.x prior to 8.2.2 contains an authorization bypass vulnerability. Authenticated non-admins can escalate privileges by exploiting unenforced field restrictions on nested relational save operations, enabling modification of sensitive User fields (roles, groups) through a relat...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

CVE-2026-5674

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

CVE-2026-56454

HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1...

CVE-2026-5674

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

EUVD-2026-44925

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

CVE-2026-5674

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

CVE-2026-5674

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

EUVD-2026-44922

HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1...

CVE-2026-15925

A flaw was found in Snowflake Connector for Python. A network-positioned attacker could exploit improper Transport Layer Security TLS hostname verification by intercepting network traffic and presenting a fraudulent certificate. This could allow the attacker to bypass certificate hostname...

SUSE-SU-2026:22693-1 Security update for the Linux Kernel RT (Live Patch 20 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094....

PT-2026-60475

Name of the Vulnerable Software and Affected Versions PipeWire affected versions not specified Description A flaw in the PulseAudio compatibility layer of PipeWire, a multimedia server, allows an attacker to escape sandboxed applications, such as Flatpak. An attacker with minimal permissions with...

PT-2026-60681

Name of the Vulnerable Software and Affected Versions github.com/kumahq/kuma/v2 versions 2.8.0 through 2.9.15 Description When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, the tool disables TLS verification. This causes API tokens to be transmitte...

Ubuntu 24.04 LTS : Linux kernel (HWE) vulnerabilities (USN-8545-1)

"The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8545-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws i...