Exploit for Missing Authentication for Critical Function in Apache Artemis

CVE-2026-57967 — Apache ActiveMQ Artemis Unauthenticated Sessi...

knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json

Overview A critical Arbitrary Code Execution ACE vulnerability exists in the Knowns Language Server Protocol LSP detection and startup pipeline. The system blindly trusts the settings.lsp.languages..binary field defined in the project-level .knowns/config.json file. Because this field is never...

netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers

In 2024, MCP Model Context Protocol set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and enterprises plugged them into agent workflows. The ecosystem around it fell short...

UBUNTU-CVE-2026-98257

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

CVE-2026-98257

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

CVE-2026-98257 rds: ib: use rds_conn_drop() on protocol version mismatch

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

Denial-of-service (DoS)

org.apache.qpid, qpid-broker-plugins-amqp-1-0-protocol is vulnerable to a Denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation...

Cisco ASA Improper Input Validation (CVE-2026-20020)

A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. If OSPF authentication is enabled, the attacker must know th...

Rockwell Automation Allen-Bradley Stratix 5950 Resource Management Errors (CVE-2018-0240)

Multiple vulnerabilities in the Application Layer Protocol Inspection feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of servi...

Linux Distros Unpatched Vulnerability : CVE-2026-98257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA- CM event handler with conn-ccmlock held. When the peer negotiat...

PT-2026-106586

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the Reliable Datagram Sockets RDS implementation for InfiniBand ib. The function rds ib cm connect complete operates within the RDMA-CM event handler while holding t...

Uncaught Exception

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Uncaught Exception via the cachesalt parameter in request protocol handlers across multiple entrypoints chat completion, completion, responses,...

CVE-2026-105741

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol MCP configuration installation endpoint POST /api/v1/mcp/project/projectid/install allowed authenticated remote attackers to bypass th...

CVE-2026-105741

The software Langflow (versions 1.5.0 through 1.10.3) is vulnerable to an IP spoofing issue within the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install). An authenticated remote attacker can bypass "local-only" access restrictions by ...