CVE-2026-16553

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in...

CVE-2026-6267: Insertion of Sensitive Information Into Sent Data

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access...

CVE-2026-67183

TinyWeb up to version 0.0.8 is affected by a memory-leak DoS caused by allocations in HttpParser::execute (Url objects, HttpHeaders, and HttpHeader instances) that are never freed due to missing destructors and unreachable deletes. Each authenticated-ill-formed? Actually unauthenticated, per-requ...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the exec request handling process. An attacker can cause the server process to crash and terminate all active connections by sending a specially crafted five-byte message with a manipulated length field...

DEBIAN-CVE-2026-64232

In the Linux kernel, the following vulnerability has been resolved: block: recompute nrintegritysegments in blkinsertclonedrequest blkinsertclonedrequest already recomputes nrphyssegments against the bottom queue, because "the queue settings related to segment counting may differ from the origina...

CVE-2026-64232 block: recompute nr_integrity_segments in blk_insert_cloned_request

In the Linux kernel, the following vulnerability has been resolved: block: recompute nrintegritysegments in blkinsertclonedrequest blkinsertclonedrequest already recomputes nrphyssegments against the bottom queue, because "the queue settings related to segment counting may differ from the origina...

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Summary The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload approximately 150 KB that expands to an arbitrarily large size in memory 1...

123pancli (1.0.0), @0xlimao/n8n-nodes-ethereum (>=1.0.0, <=1.0.1) +4616 more potentially affected by CVE-2026-67315 via axios (>=1.15.0, <=1.17.0)

axios NPM version =1.15.0, =1.0.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =0.1.0, =0.0.1, =1.0.0, =0.0.1, =1.1.2 and more Source cves: CVE-2026-67315 Source advisory: OSV:GHSA-F4GW-2P7V-4548...

DEBIAN-CVE-2026-53433

fzf is vulnerable to a Denial of Service DoS due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity On². A crafted POST request with many small segments can trigger excessive...

CVE-2026-13563 Edimax EW-7478APC POST Request formL2TPSetup stack-based overflow

A vulnerability has been found in Edimax EW-7478APC 1.04. This impacts the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. Such manipulation of the argument L2TPUserName leads to stack-based buffer overflow. It is possible to launch the attack...

CVE-2026-53273 tee: optee: prevent use-after-free when the client exits before the supplicant

In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 "tee: optee: Fix supplicant wait loop" made the client wait as killable so it can be interrupted during shutdown or after a...

PT-2026-52368

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the OP-TEE driver of the Linux kernel. This occurs when a client task terminates while a supplicant is still processing its request. Because the client m...

CVE-2023-54365 Traefik - Denial of Service via HTTP/2 Request Handling

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique. A remote attacker can rapidly create and cancel HTTP/2...

Insecure Default Initialization of Resource

Overview @kozou/mcp is a Kozou MCP server for AI agents stdio + HTTP Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insufficient validation of the Host and Origin headers in the MCP HTTP server, unbounded request-body buffering, improper...

CVE-2026-50872

An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request...

CVE-2026-50872

An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request...

CVE-2026-50872: Improper Control of Generation of Code

An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request...

CVE-2026-53912

Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflow stored the registrant’s hashed password in the inbox message data payload. This payload was returned unredacted through inbox index and view responses, including HTML, JSON, a...

GHSA-G2XQ-2V27-4RH3 Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to...

FreeSWITCH security vulnerabilities

FreeSWITCH is a free and open-source communication software developed by Anthony Minessale, an individual developer from the United States. This software can be used to create audio, video, and short message-based products and applications. Prior to FreeSWITCH version 1.11.1, there was a security...