CLEANSTART-2026-RA54974 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

Multiple security vulnerabilities affect the npm package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for individual...

CLEANSTART-2026-EC11110 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

Multiple security vulnerabilities affect the apache-superset package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for...

kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

A flaw was found in the Linux kernel's libiscsitcp component. A remote attacker, acting as a malicious iSCSI target, could send a specially crafted iSCSI SCSI Command Response ISCSIOPSCSICMDRSP with an oversized data segment. This could lead to a buffer overflow in a fixed-size buffer, potentiall...

CVE-2026-91945: Out-of-bounds Read

FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKIDCOREDEVICEIOCOMPLETION responses to trigger reads past...

CVE-2026-91945: Out-of-bounds Read

FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKIDCOREDEVICEIOCOMPLETION responses to trigger reads past...

PT-2026-93223

Name of the Vulnerable Software and Affected Versions Secret Server affected versions not specified Description Under certain conditions, a valid SAML IdP response may be used to impersonate another user. SAML Security Assertion Markup Language is an XML-based standard for exchanging authenticati...

PT-2026-97299

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.22 through 11.0.25 Apache Tomcat versions 10.1.55 through 10.1.59 Apache Tomcat versions 9.0.118 through 9.0.121 Description An inconsistent interpretation of HTTP/2 requests, known as HTTP Request/Response smugglin...

PT-2026-97284

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.47 through 9.0.121 Apache Tomcat versions 8.5.67 through 8.5.100 Description An inconsistent interpretation of HTTP...

CVE-2026-69216: Inconsistent Interpretation of HTTP Requests

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data...

PT-2026-92476

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 140.16 Thunderbird versions prior to 153.3 Thunderbird versions prior to 156 Description A malicious or compromised IMAP server can cause a crash in Thunderbird by sending an untagged ' ID' response. This triggers...

PT-2026-98432

Multiple security vulnerabilities affect the npm package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for individual...

CVE-2026-92240: Out-of-bounds Read

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and...

KLA91285 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security vulnerability can ...

CVE-2026-90819

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

EUVD-2026-78085

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

CVE-2026-90819 a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

CVE-2026-90819 a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

CVE-2026-90819

A remote HTTP response splitting vulnerability exists in a2aproject a2a-java 1.2.0 , specifically in the BasePushNotificationSender.dispatchNotification function (file: server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java) within the Authorization Header Con...

CVE-2026-90819 a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

EUVD-2026-77697

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...