openssl: QUIC ACK-only packet retention can cause memory exhaustion

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

openssl: invalid pointer dereference in CMP server via crafted protectionAlg

A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...

CVE-2026-78966

Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

brutespray v2.7.2

Brutespray Created by: Shane Young/@x90sky && Jacob Robles/@shellfail Inspired by: Leon Johnson/@sho-luv Description Brutespray automatically attempts default credentials on discovered services. It takes scan output from Nmap GNMAP/XML, Nessus, Nexpose, JSON, and lists, then brute-forces...

USN-8658-3: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Open vSwitch; - SCTP protocol; CVE-2026-53224, CVE-2026-53246, CVE-2026-64531...

USN-8658-3 linux-azure, linux-azure-fde, linux-nvidia-tegra-igx vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Open vSwitch; - SCTP protocol; CVE-2026-53224, CVE-2026-53246, CVE-2026-64531...

USN-8643-4 linux-aws-6.8, linux-azure-fde, linux-azure-fde-6.8, linux-azure-fips, linux-nvidia-tegra vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network drivers; - Open vSwitch; - SCTP protocol; CVE-2026-53224, CVE-2026-53246, CVE-2026-53247, CVE-2026-64531...

USN-8643-4: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network drivers; - Open vSwitch; - SCTP protocol; CVE-2026-53224, CVE-2026-53246, CVE-2026-53247, CVE-2026-64531...

SUSE-SU-2026:3803-1 Security update for LibVNCServer

This update for LibVNCServer fixes the following issue: - CVE-2026-50538: a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker- controlled data past the end of its framebuffer bsc1276218...

Security Bulletin: Vulnerability in Faraday affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Faraday has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabili...

Security Bulletin: Vulnerability in Faraday affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Faraday has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabili...

CVE-2026-63076

A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...

GHSA-QJ6X-XX2H-8HVV Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

Summary The media embed renderer trusts serialized provider or sourceUrl metadata and skips the URL protocol validation that normally blocks unsafe media embed URLs. A crafted Plate document can set a known video provider while keeping url as a javascript: iframe source. When a victim opens that...

CVE-2026-63075

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

AZL-97944 CVE-2026-63074 affecting package openssl for versions less than 3.3.7-6

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

ALPINE-CVE-2026-63074

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

CVE-2026-63074

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

CVE-2026-63076

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

AZL-97674 CVE-2026-63076 affecting package openssl-fips-provider 3.1.2-2

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

CVE-2026-63074

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...