PT-2026-61426

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the af unix module. The unix stream data wait function calls skb peek tail on the sk-sk receive queue without holding a lock to prevent Socket Buffer...

PT-2026-61334

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free bug exists in the blk-mq component when submitting a bio. The issue occurs if a task sleeps after peeking at a cached request but before popping it, causing the plug to...

PT-2026-61492

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iwlwifi driver where the iwl mld tx from txq function fails to check the mld-fw status.in hw restart flag before dequeuing frames from mac80211 and pushing them to...

PT-2026-61290

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference issue exists in the net: mana component. When queue allocation fails during the attach process, the error cleanup routine frees and sets apc-tx qp and apc-rxqs...

PT-2026-61176

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the airoha qdma cleanup tx queue function where DMA TX descriptors were not being reset. This mirrors a similar issue found in airoha qdma cleanup rx queue...

PT-2026-61151

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the batman-adv module when a hard interface is disabled. While the worker is disabled via batadv hardif disable interface and batadv v ogm iface disable, and the...

OPENSUSE-SU-2026:21372-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption...

MGASA-2026-0257 Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

Adaptive Incident Prioritization for Security Operations at Scale

Large security operations centers SOCs often face hundreds of active incidents per day, creating substantial cognitive and operational demands for analysts. Analysts must quickly decide which incidents deserve attention within long, constantly changing queues, yet incidents are commonly ordered b...

CVE-2026-48045

The CVE-2026-48045 issue affects python-zeroconf (Zeroconf Pure Python) where AsyncListener.handle_query_or_defer retains every truncated TC-bit mDNS query per source in self._deferred[addr] and arms per-address timers in self._timers[addr]. This unbounded queue growth on LAN-local hosts (UDP/535...

CVE-2026-48045 Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handlequeryordefer retained every truncated TC-bit incoming query, each up to MAXMSGABSOLUTE = 8966 bytes, in self.deferredaddr and armed a per-address timer in self.timersaddr without...

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

The vulnerability of the Microsoft Message Queuing (MSMQ) queue service on Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Message Queuing MSMQ service on Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...

SQUIRO: A Framework for Security-Aware Quantum-Classical Scheduling on Kubernetes

Distributed infrastructure schedulers traditionally optimise capacity, locality, and cost, but provide limited support for security posture and emerging quantum-classical workloads. As hybrid quantum-classical computing becomes increasingly practical and post-quantum security requirements begin t...

EUVD-2026-44934

SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when...

CVE-2026-59249

Inconsistent interpretation of HTTP requests HTTP response smuggling vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that shar...

CVE-2026-59249

The CVE concerns the Elixir Mint library (mint) and its HTTP/1.1 decoding path. Specifically, Mint.HTTP1.decode_body/5 parses chunk-size lines using Integer.parse(data, 16), which accepts a leading + or - despite RFC 7230 requiring unsigned hex digits. This leads to a mismatch with RFC-strict int...

PT-2026-60461

Inconsistent interpretation of HTTP requests HTTP response smuggling vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that shar...

CVE-2026-59249: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP requests HTTP response smuggling vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that shar...