PT-2026-56679

Name of the Vulnerable Software and Affected Versions zalando/skipper versions prior to 0.26.10 Description The OpenPolicyAgent integration in zalando/skipper contains a flaw that allows request-body inspection to be bypassed. This occurs during HTTP/1.1 requests using Transfer-Encoding: chunked...

PT-2026-67272

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A buffer over-disclosure issue exists in the gateway WebSocket transport within the libfreerdp/core/gateway/websocket.c file. The client uses a fixed 1024-byte response stream for Pong replies witho...

Apache ActiveMQ input validation error vulnerability (CNVD-2026-28238)

Apache ActiveMQ is a message queue middleware developed by the Apache Foundation. There are security vulnerabilities in Apache ActiveMQ. Attackers can exploit these vulnerabilities to enable remote, unauthenticated peers to trigger denial-of-service attacks by sending negative content-length...

GnuTLS merge_handshake_packet() DoS

The vulnerability of the mergehandshakepacket function in the GnuTLS cryptographic library is related to errors in processing parameter values related to input data length. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-24699

An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in certain Cisco routers. The vulnerability is caused by improper sanitization of the lan_ipv6_prefixlen configuration parameter. This flaw could allow an authenticated remote attacker to execute arbitrary...

PT-2026-56474

Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.04-rc4 Description An out-of-bounds read occurs in the tcp rx state machine function net/tcp.c when CONFIG PROT TCP is enabled. A remote attacker can read beyond TCP segment boundaries by sending a malicious packe...

PT-2026-61020

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description The software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can send a specially crafted packet th...

RockyLinux 9 : 389-ds-base (RLSA-2026:36195)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36195 advisory. 389-ds-base: 389-ds-base: Heap buffer overflow in sasliorecv via padded SASL UNBIND CVE-2026-11610 389-ds-base: 389-ds-base: integer overflow in SASL...

Buffer Access with Incorrect Length Value

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Buffer Access with Incorrect Length Value in the GDALRaster process when constructed from a bytes object. An attacker can access...

Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

SummaryPicklescan uses the numpy.f2py.crackfortran.evallength function a NumPy F2PY helper to execute arbitrary Python code during unpickling. DetailsPicklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.evallength in reduce, allowing arbitrary command executi...

PYSEC-2026-1486 Keras Directory Traversal Vulnerability

Summary Keras's keras.utils.getfile function is vulnerable to directory traversal attacks despite implementing filtersafepaths. The vulnerability exists because extractarchive uses Python's tarfile.extractall method without the security-critical filter="data" parameter. A PATHMAX symlink resoluti...

Keras Directory Traversal Vulnerability

SummaryKeras's keras.utils.getfile function is vulnerable to directory traversal attacks despite implementing filtersafepaths. The vulnerability exists because extractarchive uses Python's tarfile.extractall method without the security-critical filter="data" parameter. A PATHMAX symlink resolutio...

PYSEC-2026-1330 ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

Summary On the ESP-IDF platform, ESPHome's webserver authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value e.g., correct username with partial password. This allows access to webserver functionality...

Vyper's `slice()` may elide side-effects when output length is 0

Impactthe slice builtin can elide side effects when the output length is 0, and the source bytestring is a builtin msg.data or .code. the reason is that for these source locations, the check that length = 1 is...

PYSEC-2026-2029 Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Impact concat may skip evaluation of side effects when the length of an argument is zero. this is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero:...

PYSEC-2026-2028 Vyper's `slice()` may elide side-effects when output length is 0

Impact the slice builtin can elide side effects when the output length is 0, and the source bytestring is a builtin msg.data or .code. the reason is that for these source locations, the check that length = 1 is skipped:...

Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Impactconcat may skip evaluation of side effects when the length of an argument is zero. this is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is...

Gunicorn HTTP Request/Response Smuggling vulnerability

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data...

Open WebUI Uncontrolled Resource Consumption vulnerability

In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to the lack of character length validation on these inputs. This vulnerability can lead to a Denial of Service DoS condition when a us...

Werkzeug possible resource exhaustion when parsing file data in forms

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.maxformmemorysize setting.The Request.maxcontentlength setting, as well as resource limits provided by deployment software and platforms, a...