Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-2084)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2084 advisory. A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory...

OPENSUSE-SU-2026:21687-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

OESA-2026-3584 wireshark security update

Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fixes: C12.22...

OESA-2026-3583 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack...

OESA-2026-3581 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attack...

OESA-2026-3564 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

OESA-2026-3555 vim security update

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Securi...

org.webjars.npm:adal-node (0.1.28), org.webjars.npm:body-parser (>=1.16.1, <=2.0.0-beta.1) +34 more potentially affected by CVE-2026-82562 via org.webjars.npm:qs (>=6.2.0, <=6.13.0)

org.webjars.npm:qs MAVEN version =6.2.0, =1.16.1, =1.5.2, =4.14.0, =2.0.0-canary.20210330, =3.3.2, =0.2.14, =2.3.0, =8.5.0, =13.2.0 - org.webjars.npm:jsonld 0.4.11 and more Source cves: CVE-2026-82562 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-19432018...

SUSE CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

CVE-2026-82562

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...

CVE-2026-82417

Summary "qs.stringify" throws a "TypeError" when it serializes an object whose own "constructor" property has a truthy, non-callable "isBuffer" member. "utils.isBuffer" duck-types buffers by calling "obj.constructor.isBufferobj" after checking only that the property is truthy, so a value such as ...

fast-uri: fast-uri: Host confusion via skipped IDN canonicalization

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...

fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...

fast-uri: fast-uri: Host confusion via skipped IDN canonicalization

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...

fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...

fast-uri: fast-uri: Host confusion via skipped IDN canonicalization

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...

fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

SUSE CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...