CVE-2026-48039

CVE-2026-48039 : In Meta Ads MCP, versions before 1.0.109 suffer an authentication bypass where AuthInjectionMiddleware.dispatch() forwards unauthenticated /mcp requests to tool handlers, and when no per-request credential exists, falls back to META_ACCESS_TOKEN. The downstream Graph API error pa...

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

PortSwigger says HTTP Terminator, an artificial intelligence AI-assisted research system built by James Kettle , generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. PortSwigger said a separate human-guided discovery cascade also exposed a...

OESA-2026-3302 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTORAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTORAW 255 was dangerous...

Cisco IOS Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)

According to its self-reported version, Cisco IOS is affected by a denial of service vulnerability. A flaw exists in the Extensible Messaging Client Protocol XMCP due to improper handling of malformed XMCP packets. An unauthenticated, remote attacker can exploit this issue, via a malformed XMCP...

Cisco IOS XE Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)

According to its self-reported version, Cisco IOS-XE Software is affected by a denial of service vulnerability. A flaw exists in the Extensible Messaging Client Protocol XMCP due to improper handling of malformed XMCP packets. An unauthenticated, remote attacker can exploit this issue, via a...

Cisco IOS XE Software SNMP DoS (cisco-sa-iosxe-snmp-dos-ZAqNm4MD)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. - A vulnerability in the SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due ...

Linux Distros Unpatched Vulnerability : CVE-2026-8400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Jav...

Node.js Module axios 1.13.0 < 1.18.0 maxBodyLength Bypass (CVE-2026-67318)

The version of the axios Node.js module installed on the remote host is 1.13.0 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios fails to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2...

openSUSE 16: libwireshark18 / libwiretap15 / libwsutil16 / wireshark / etc (openSUSE-SU-2026:21534-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21534-1 advisory. Update to version 4.4.17. - CVE-2026-6867: SMB2 protocol dissector crash bsc1263727. - CVE-2026-7375: UDS protocol dissector infinite loop...

SUSE CVE-2026-64564

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctprcv. For an ASCONF located...

CVE-2026-71324

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

h2: Duplicate Host header could facilitate request smuggling

Impact h2 =4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive CWE-444...

CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

Summary The AttributesExtension's href/src unsafe-link filter AttributesHelper::filterAttributes can be bypassed by embedding control bytes in a javascript: URL that browsers discard before parsing the scheme. Two variants: - Tab/newline inside the scheme — a literal ASCII TAB 0x09, CR 0x0D, or...

CVE-2026-5855

Contiki-NG: LwM2M TLV parser in os/services/lwm2m/lwm2m-tlv.c (function lwm2m_tlv_read) ignores the caller’s buffer length and may read up to six bytes without bounds checks. The engine loop continues while bytes remain, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exact...

CVE-2026-54463

A flaw was found in websocket-driver, a WebSocket protocol handler. A remote attacker could exploit a vulnerability in how draft versions of the WebSocket protocol handle length headers. By sending an indefinite sequence of specially crafted bytes, an attacker can cause the affected component to...

CVE-2026-70637

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes datasocket and filefd descriptors while worker threads concurrently...

CVE-2026-66733 Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The...

CVE-2026-67296

A flaw was found in FreeRDP. A remote attacker can exploit a vulnerability in the Remote Desktop Protocol RDP Enhanced Input RDPEI server channel handler. By sending a malicious RDPEI message with an oversized declared body length, the attacker can force the server to allocate excessive memory,...