PT-2026-63376

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.13.2 through 1.25.1 Description An off-by-one error exists in the harden-below-nxdomain logic, which is enabled by default. This issue occurs when stub or forward zones are located below an intermediate label that...

PT-2026-63385

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.25.0 through 1.25.1 Description A memory corruption issue exists when the software is under pressure and configured with an access-control-view and either the respip or rpz modules, alongside a module capable of...

RockyLinux 8 : glibc (RLSA-2026:42733)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42733 advisory. glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings CVE-2026-5928 glibc: glibc:...

Debian dsa-6395 : bind9 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6395 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6395-1 [email protected] https://www.debian.org/securit...

PT-2026-63388

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.10.0 through 1.25.1 Description A remote client controlling a delegated domain can cause the daemon to crash, leading to a denial of service. This occurs when the serve-expired: yes setting is enabled alongside a...

CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

CVE-2026-63975

A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...

CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

Gitea: Webhook Authorization Header Returned in Plaintext via API

Summary The ToHook function in services/webhook/general.go decrypts the webhook's HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. Any repository admin can read the full plaintext value of webhook authorization headers Bearer tokens, Basic aut...

CVE-2026-56579

HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security...

Security Bulletin: XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-36431)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed XSS vulnerability. Vulnerability Details CVEID:CVE-2025-36431 DESCRIPTION: IBM Sterling File Gateway is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScrip...

EUVD-2026-46342

HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security...

CVE-2026-56579 HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor.

HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security...

CVE-2026-56579

CVE-2026-56579 concerns HCL MyCloud where a license key is exposed in HTTP responses, enabling potential misuse of exposed information and compromising application security. The available sources confirm the issue and describe the risk as arising from sensitive data leakage, but they do not speci...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

glibc: glibc: Application crash or uninitialized memory read via crafted DNS response

A flaw was found in glibc GNU C Library. The deprecated functions nsprintrrf, nsprintrr, and fpnquery do not properly validate the length of RDATA Resource Record Data in a DNS Domain Name System response when processing specific record types like LOC, CERT, TKEY, or TSIG. A remote attacker could...

EUVD-2026-46276

A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the...

SUSE CVE-2026-63887

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates "key=value\0" records into login-rspbuf, an 8192-byte kzallocMAXKEYVALUEPAIRS buffer allocated in iscsitallocloginsetupbuffer...

SUSE CVE-2026-63995

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

SUSE CVE-2026-64083

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject short block-read responses in the GPIO accessors adm1266gpioget and adm1266gpiogetmultiple both compose the pin-status word as pinsstatus = readbuf0 + readbuf1 8; right after i2csmbusreadblockdata,...