kernel: nvmet-tcp: fix race between ICReq handling and queue teardown

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. A race condition exists between the handling of an Initialization Connection Request ICReq and the teardown of a queue. A remote attacker, by sending an ICReq and immediately closing the connection, could trigger a...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

CVE-2026-17897

Inappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17897

CVE-2026-17897 affects Google Chrome/Chromium’s ORB implementation. A remote attacker could leak cross-origin data via a crafted HTML page due to an inappropriate ORB implementation, with the vulnerability present in Chrome prior to 151.0.7922.72. A remediation is provided in the 2026-07 stable-c...

Linux Distros Unpatched Vulnerability : CVE-2026-58044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible...

RockyLinux 9 : kernel (RLSA-2026:47040)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47040 advisory. kernel: xfrm: Duplicate SPI Handling CVE-2025-39797 kernel: lib/buildid: use kernelread for sleepable context CVE-2026-23002 kernel: futex: Drop...

SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure

Overview Six vulnerabilities have been discovered within the SGLang project, including remote code execution RCE, server-side request forgery SSRF, local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, an...

PT-2026-66623

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw exists in the ACSE layer during the processing of AARQ PDUs Application Association Request Protocol Data Units during MMS connection establishment. An...

UBUNTU-CVE-2026-24033

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the iss...

UBUNTU-CVE-2026-57834

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

UBUNTU-CVE-2026-58155

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

PT-2026-66560

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An SSRF Server-Side Request Forgery and local file read issue exists in the multimodal generation endpoint '/v1/chat/completions'. This occurs because the image url variable is not properly...

UBUNTU-CVE-2026-58150

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4...

Linux Distros Unpatched Vulnerability : CVE-2026-18369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects...

HTTP Request Smuggling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interceptors.retry flow in lib/handler/retry-handler.js. An attacker can cause a proxy or gateway that forwards Undici responses to emit...

CRLF Injection

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to CRLF Injection via the writeH1 path in lib/dispatcher/client-h1.js. An attacker can append arbitrary HTTP headers or smuggle a second request by supplying a duck-typed...

CVE-2026-15157

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

DEBIAN-CVE-2026-15157

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

CVE-2026-15157

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

CVE-2026-15975

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing...