CVE-2026-74696 tcp: fix TFO max_qlen accounting across reuseport migration

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO maxqlen accounting across reuseport migration A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SOREUSEPORT...

CVE-2026-74696

CVE-2026-74696 is a denial-of-service vulnerability in the Linux kernel's TCP Fast Open (TFO) implementation. The root cause is an accounting error in fastopenq.qlen during SO_REUSEPORT listener migration : when a listener is closed and its pending TFO children are handed to a surviving listener,...

PT-2026-79701

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max qlen accounting across reuseport migration A listener's TCP FASTOPEN max qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO...

Linux Distros Unpatched Vulnerability : CVE-2026-74696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: fix TFO maxqlen accounting across reuseport migration A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open...

Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set. Impact This affects any project relying on graphql.maxTake ...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

EUVD-2026-63423

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69222 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.joinsep. The concat filter can cheaply doub...

CVE-2026-69222 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.joinsep. The concat filter can cheaply doub...

EUVD-2026-62850

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738

Lemmy , a fediverse link aggregator and forum, is vulnerable to rate limit bypass via X-Forwarded-For header spoofing in versions prior to 0.19.19 and 1.0.0-beta.1 . The root cause is that actix-web's ConnectionInfo::realip_remote_addr reads the first value of X-Forwarded-For as the client addres...

PT-2026-78696

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1 Description An issue exists where the ConnectionInfo::realip remote addr function in actix-web reads the first value of the X-Forwarded-For header as the client address used ...

EUVD-2026-61131

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/sharedfunc.py logs that an archive member exceeding ZIPMAXUNCOMPRESSEDFILESIZE is being skipped but does not continue to the next member, so an authenticated user can...

CVE-2026-50139

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

CVE-2026-50139 goshs: Share-link ?token=… redemption races past download limit

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

EUVD-2026-60364

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...