PT-2026-90193

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the SCTP implementation of the Linux kernel. The issue occurs when completing a pending stream reconfiguration request that has been published in...

Fedora 44 : curl (2026-f26b509a1a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f26b509a1a advisory. - Fix HTTP/2 stream-dependency tree UAF CVE-2026-10536 - Fix Native CA trust persist CVE-2026-11564 - Fix stale proxy password leak CVE-2026-9079 -...

CVE-2026-54241: Heap-based Buffer Overflow

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an...

PT-2026-89865

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-45765 Suricata dnp3: unbounded reassembly can lead to resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory,...

netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec

A flaw was found in Netty. A remote attacker can exploit a vulnerability in the SpdyHttpDecoder handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated SYNSTREAM frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This...

CVE-2026-88874

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

CVE-2026-88865

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

EUVD-2026-75428

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88878

Traefik (HTTP reverse proxy and load balancer) versions v2.8.2 through v2.11.55 and v3.0.0 through v3.7.11 are affected by an HTTP/3 timeout bypass. The respondingTimeouts settings (notably readTimeout, default 60s) are not applied to the HTTP/3 request path because readTimeout is enforced as a d...

CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88878

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88874

AVideo (through revision c3edcc274c389816d434acadac07ee78eaf330c1, 2026-08-23) suffers from an authentication bypass in its live streaming feature. The Live::_getStats() method (plugin/Live/Live.php) exposes the RTMP stream key, isPasswordProtected flag, and HLS (m3u8) URL to unauthenticated call...

CVE-2026-88874 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

CVE-2026-88874 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

CVE-2026-88865 AVideo Missing Authorization via getRestream.json.php

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

CVE-2026-88865 AVideo Missing Authorization via getRestream.json.php

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

CVE-2026-88865

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php . Authenticated users holding the canStream permission can mint tokens for arbitrary restreams, then exchange those tokens to retrieve other users' stream keys from getLiveK...

EUVD-2026-75415

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...