CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

CVE-2026-16728

Undici contains a defect in its retry interceptor: after a retry or resume of a partial response, it can assemble a body whose length differs from the Content-Length observed by the application. In affected ranges (before 6.28.0, 7.0.0–7.28.x, and 8.0.0–7.29.0 to 8.8.x), a faulty upstream may ret...

CVE-2026-16728 undici vulnerable to downstream response desynchronization via retry interceptor

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

CVE-2026-16728 undici vulnerable to downstream response desynchronization via retry interceptor

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

CVE-2026-16728 undici vulnerable to downstream response desynchronization via retry interceptor

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

PT-2026-65907

Name of the Vulnerable Software and Affected Versions undici versions prior to 6.28.0 undici versions 7.0.0 through 7.28.x undici versions 8.0.0 through 8.8.x Description The retry interceptor can deliver a response where the body length does not match the Content-Length header after a retry or...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

Oracle MySQL J Connector (July 2026 CPU)

The 9.7.x versions of MySQL Connector/J installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 9.7.0-9.7.1...

Oracle APEX (CVE-2026-54285) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: Third Party OpenTelemetry as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: Third Party OpenTelemetry. Easily exploitable vulnerability allows...

CVE-2026-17569

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...

CVE-2026-17569

CVE-2026-17569: Improper access control in the NetBox synchronizer of Devolutions Server allows an authenticated user with view-only access on an entry to retrieve a stored API token via the partial connection endpoint. Affected products/versions include Devolutions Server 2026.2.4.0 through 2026...

CVE-2026-17569

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...

EUVD-2026-49379

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...

CVE-2026-17569

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...

CVE-2026-66730

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66730

CVE-2026-66730 concerns facil.io versions 0.6.0–0.7.6, where the multipart body parser is vulnerable to a denial-of-service. The root cause is a missing progress guard in the parser loop: http_mime_parse can return 0 bytes consumed without setting done or error flags, causing the caller to repeat...

CVE-2026-66730 facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66730 facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...