CVE-2026-57566

The Readest ebook reader (versions prior to 0.11.10 ) contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /api/opds/proxy route. The application fails to restrict URL schemes or block private, loopback, link-local, or metadata hosts when fetching attacker-controlle...

CVE-2026-113783

The ESP-IDF (Espressif Internet of Things Development Framework) contains a stack-based buffer overflow in the lwIP DNS resolver 's cached-lookup path within dns_lookup() in dns.c. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname contains multiple A or AAAA records, the sy...

CVE-2026-120678

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth i...

Important: Red Hat Security Advisory: bind security, bug fix, and enhancement update

An update for bind is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2026-120678

A flaw was found in the MongoDB C Driver. An unauthenticated attacker who controls a database server can cause a Denial of Service DoS against connecting client applications. Due to improper memory management when handling compressed server responses, the client library fails to release allocated...

DEBIAN-CVE-2026-120678

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth i...

CVE-2026-120678

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth i...

CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses=... route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response...

CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses=... route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response...

CVE-2026-63469

The fastapi-code-generator tool (prior to version 0.8.1 ) is vulnerable to Remote Code Execution (RCE) during the application generation process. The root cause is a code injection vulnerability where the generator inserts a response status-code key into a generated responses={...} route-decorato...

EUVD-2026-116133

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth i...

Security update for libsoup

This update for libsoup fixes the following issue: CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling bsc1283831. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

bind: BIND: Denial of Service via malformed DNS64 responses

A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the named process to exit unexpectedly. This can lead to a Denial of Service DoS for clients relying on the affected resolver...

Coldai Aono FastAPI code generator improper output handling vulnerability

Versions of Koudai Aono FastAPI Generator prior to 0.8.1 contain a security vulnerability. This vulnerability arises because the generator fails to escape embedded quotes when inserting additional response status code keys into the responses route decorator dictionary. Attackers can exploit this ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing begins reassembly for active DATA responses prior to matching them to any outstanding sends. The actual matching occurs later, after...

CVE-2026-119285

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdoma...

CVE-2026-120216 fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout...

CVE-2026-120216 fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout...

CVE-2026-120216 fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout...

CVE-2026-119279

A flaw was found in MariaDB Connector/J. A malicious or compromised database server, or an attacker intercepting network traffic, can cause a Denial of Service DoS by sending crafted responses containing excessively large length values. Because the connector converts these protocol values into...