CVE-2026-65838 Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check

A flaw was found in golang.org/x/crypto/ssh. The Verify method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially...

CVE-2026-24332

CVE-2026-24332 – Discord 不可視モードのプレゼンス漏洩 概要 このリポジトリは、Discord クライアントおよび API に影響を与える未修正のプライバシー問題である CVE-2026-24332 について文書化したものです。 この脆弱性により、外部クライアントは、不可視 に設定されたユーザーが実際にオンラインであるかどうかを判別できます。 詳細 CWE-200: 機密情報の漏洩 CVSS: 4.3 中 ステータス: 未修正 2026年時点 影響: プライバシー漏洩 Discord の WebSocket プレゼンスシステムは、不可視ユーザーを presence...

EUVD-2026-42050

Phoenix: Presence keys colliding with Object.prototype members break existence checks...

Phoenix: Presence keys colliding with `Object.prototype` members break existence checks

Summary The Phoenix JavaScript presence client assets/js/phoenix/presence.js tests whether a presence already exists using a bare truthiness check statekey rather than an own-property check. Because applications commonly track presences under a client-supplied username or id, the presence key can...

AZL-98490 CVE-2026-73812 affecting package erlang for versions less than 26.2.5.21-6

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

Astra Linux – Vulnerability in PackageKit

PackageKit provided detailed error messages to unprivileged callers who were exposed to information about the presence of files and their mimetypes. This information was difficult for those callers to determine on their own...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: net-sysfs: added a check to ensure netdevice is present before using speedshow. When disabling the netdevice or during system shutdown, a panic may occur when accessing the sysfs path, because the device has already been removed...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ethtool: checks whether the device is present when obtaining link settings. A sysfs reader may race with a device that is reset or removed, attempting to read the device’s state when the device is not actually present. For exampl...

MINI-QCCH-7JHP-M852

Bulletin has no description...

MINI-GFRM-3QXH-RJ4F

Bulletin has no description...

CVE-2026-71277

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

CVE-2026-45809

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a...

CVE-2026-45809

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a...

CVE-2026-45809

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a...

CVE-2026-45809

OpenSIPS denial-of-service in watcherinfo XML generation (CVE-2026-45809). Affected: OpenSIPS before 3.6.6 and 4.0.0-rc1. Root cause: copying the stored watcher URI into a fixed-size stack buffer during presence.winfo watcherinfo XML generation when an oversized watcher entry is created by a long...

CVE-2026-45809 OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a...

EUVD-2026-53002

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a...

CVE-2026-45809 OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a...