CVE-2026-85078

Sanic is an open-source Python web server/framework. In version 25.12.0 , its core HTTP/1.1 chunked-body handling fails to fully consume the trailer portion after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-control...

CVE-2026-85078

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controll...

CVE-2026-85078 sanic chunked trailer request smuggling allows hidden second request execution

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controll...

CVE-2026-85078 sanic chunked trailer request smuggling allows hidden second request execution

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controll...

CVE-2026-85078 sanic chunked trailer request smuggling allows hidden second request execution

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controll...

Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure in the InitializeProcessor::handleDebuggerRequest process when the debugger is enabled. An attacker can access sensitive...

CVE-2026-81632

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...

RLSA-2026:67909 Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...

RLSA-2026:67908 Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...

BIT-MONGODB-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

Malicious code in koa-request-backend-cors (npm)

Source: amazon-inspector 08921411e6ecc93fa3ef8d34a42907e38e7b700460a3ee414b6b545798b2915c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in karma-repository-request-helmet (npm)

The package karma-repository-request-helmet was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jwt-tethys-eleventy-request (npm)

Source: amazon-inspector 566ab5195a913e703f2510e429b5fde782181dae4b9be1302041922eef69bd85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-85128 Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved...

CVE-2026-25281

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...

EUVD-2026-81328

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...

CVE-2026-25281 Allocation of Resources Without Limits or Throttling in OOBM

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...

CVE-2026-25281 Allocation of Resources Without Limits or Throttling in OOBM

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...

CVE-2026-25281

CVE-2026-25281 is an Allocation of Resources Without Limits or Throttling vulnerability in Qualcomm OOBM (Out-Of-Band Management). The root cause is insufficient memory allocation validation when processing large or numerous request buffers, leading to a transient denial of service . The CVSS 3.1...

PT-2026-95088

Name of the Vulnerable Software and Affected Versions MitraStar GPT-2741GNAC-N2-SV version BR g8.10 1.11WVK.0b46 Description Authenticated users can execute arbitrary operating system commands through the ping diagnostics and similar functions. This occurs via concatenated parameters sent in a...