nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance

A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure...

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

send v4.1.1

@fastify/send Send is a library for streaming files from the file system as an HTTP response supporting partial responses Ranges, conditional-GET negotiation If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, high test coverage, and granular events which may be leveraged to take...

Linux Distros Unpatched Vulnerability : CVE-2026-68196

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wilc1000: validate assoc response length before subtracting header wilcparseassocrespinfo computes the trailing IE length as ieslen = bufferlen - sizeofr...

STAIR: Effective Incident Response Using an End-To-End Agentic Planning Framework

Incident response planning is critical for restoring compromised software systems after cyberattacks. Common practice relies on expert-driven playbooks that encode fixed response procedures, but these static workflows struggle to adapt to evolving incident states, changing recovery objectives, an...

Linux Distros Unpatched Vulnerability : CVE-2026-68340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array...

CVE-2026-68340: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...

PT-2026-69463

Name of the Vulnerable Software and Affected Versions NASA HyperCP main branch Description An OS command injection issue exists where a network-adjacent attacker can execute arbitrary system commands on a researcher's workstation by intercepting or spoofing responses from the...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.2 (AXSA:2026-1500:11)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1500:11 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block...

PT-2026-69766

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the uvc send response function where the system builds a UVC control response using a user-supplied uvc request data structure. The req-length variable is clamped to...

PT-2026-69596

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wilc1000 wifi driver where the wilc parse assoc resp info function fails to validate the length of a received association response before subtracting the header...

CVE-2026-71966: Improper Neutralization of Special Elements used in an OS Command

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

PT-2026-69917

Name of the Vulnerable Software and Affected Versions CyberPanel version 2.4.3 Description An authenticated command injection issue exists in the remote backup transfer feature. Authenticated attackers can execute arbitrary OS commands by controlling the API response of a remote server. By...

PT-2026-69740

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The OCC poll response parser in the hwmon module fails to properly validate the boundaries of sensor data blocks. The parser incorrectly uses the static backing-array capacity as the...

PT-2026-69746

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ALSA hda cs35l41 component, the cs35l41 get acpi mute state function evaluates a DSM method to retrieve the ACPI mute state. The function fails to free the returned ACPI object,...

Linux Distros Unpatched Vulnerability : CVE-2026-68343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: validate DFS referral PathConsumed parsedfsreferrals validates that the response contains the fixed referral entry array and, on for-next, the...

CVE-2026-19375

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

Live-Forensicator v4.2.0

🛡️ Forensicator 🛡️ Cross-platform Incident Response & Live Forensics Toolkit Windows PowerShell | Linux Bash | macOS Shell Built for fast, structured, and actionable forensic investigations. 🤔 About Forensicator is a cross-platform incident response and live forensics toolkit. It is designed to...

gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

...

EUVD-2026-54869

A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component runopenlane/viewwaveform. The manipulation of the argument designname/vcdfile leads to command injection. Local access is required to approach this...