CVE-2026-114651

A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver allows for potential data leakage. By providing specially crafted serialized input, an unauthenticated party can cause the application to return residual bytes from unrelated data processed earlier on the sa...

CVE-2026-114651 Cross-document data leak via malformed BSON array parsing in reused thread buffer

A memory-handling weakness in the BSON deserialization component of the MongoDB C Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps...

CVE-2026-114651 Cross-document data leak via malformed BSON array parsing in reused thread buffer

A memory-handling weakness in the BSON deserialization component of the MongoDB C Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps...

CVE-2026-112935 filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...

CVE-2026-112935 filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...

CVE-2026-112935

The filelock library, a platform-independent file lock for Python, is vulnerable to a TOCTOU Race Condition in its SoftFileLock component. In versions 3.22.0 through 4.2.0 , an attacker can free their own marker after a stale read. If an honest contender subsequently creates a live successor on a...

CVE-2026-112935 filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...

Missing Critical Step in Authentication

Overview Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the authenticateUser method in ShiroSecurityProcessor in the Shiro component. An attacker can access Shiro-protected routes as an authenticated user by sending an exchange that names a princip...

CVE-2026-86409

A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 AWS SigV4 authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled...

CVE-2026-92389

A flaw was found in curl. When handling Trivial File Transfer Protocol TFTP transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive...

RUSTSEC-2026-0391 Data from an abandoned stream leaks into the next stream on a reused context

The withcontext constructors of the stream encoders and decoders used the borrowed context as it was. When a stream was abandoned on a context, for example an encoder dropped before finish after an error, whatever it left there was carried into the next stream: the input buffered by the previous...

Data from an abandoned stream leaks into the next stream on a reused context

The withcontext constructors of the stream encoders and decoders used the borrowed context as it was. When a stream was abandoned on a context, for example an encoder dropped before finish after an error, whatever it left there was carried into the next stream: the input buffered by the previous...

Astra Linux – Vulnerability in Firefox and Thunderbird

When reusing existing popups, Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

Astra Linux – vulnerability in linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset the binding mark of a reused connection Steve French reported a null pointer dereference error from the sha256 library. cifs.ko can send session setup requests on reused connections. If a reused connection is used fo...

curl: curl: TFTP direction confusion

A flaw was found in curl. When handling Trivial File Transfer Protocol TFTP transfers, a malicious server can trigger information disclosure by responding to a download request in a way that forces the client into transmit mode. Consequently, the client may unintentionally send leftover sensitive...

curl: curl: stale SigV4 headers sent unintended

A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 AWS SigV4 authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled...

PT-2026-86741

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

SUSE CVE-2026-71225

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...

CVE-2026-54497

CVE-2026-54497 (ViewComponent, Ruby on Rails) : Affected through ViewComponent::Base from 4.0.0 to 4.11.x where render_in can retain render-scoped objects across invocations. Reusing the same component instance (or collection/spacer) across requests/threads can cause stale request context, helper...