PT-2026-99097

Name of the Vulnerable Software and Affected Versions Ciena Navigator Network Control Suite NCS affected versions not specified Description An information exposure issue exists in an event-streaming API that fails to properly enforce authentication. An unauthenticated attacker with network access...

CVE-2026-5267: Missing Authentication for Critical Function

Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...

CVE-2026-9375

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API preloadcontent=False when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the maxlength protection introduced in version 2.6.0 to mitigate CVE-2025-66471...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service and open redirect due to urllib3 (CVE-2025-50181, CVE-2025-66418, CVE-2025-66471)

Summary Potential vulnerabilities in urllib3 package CVE-2025-50181, CVE-2025-66418, CVE-2025-66471 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-50181 DESCRIPTION: urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is...

EUVD-2026-75364

An issue was discovered in Bosch Sensortec COINESSDK versions 2.0 through 2.11. The host streaming API function coinesreadstreamsensordata fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in commintfprocessstreamresponse...

PT-2026-89335

An issue was discovered in Bosch Sensortec COINES SDK versions 2.0 through 2.11. The host streaming API function coines read stream sensor data fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in comm intf process stream...

NewStart CGSL MAIN 7.02 : python-urllib3 Multiple Vulnerabilities (NS-SA-2026-0104)

The remote NewStart CGSL host, running version MAIN 7.02, has python-urllib3 packages installed that are affected by multiple vulnerabilities: - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly...

TencentOS Server 3: resource-agents (TSSA-2026:0915)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0915 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

SUSE-SU-2026:23176-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue: - CVE-2026-9375: oversized Brotli payload via the streaming API can lead to a denial of service bsc1268683...

SUSE-SU-2026:23048-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue: - CVE-2026-9375: oversized Brotli payload via the streaming API can lead to a denial of service bsc1268683...

Security update for python-urllib3

This update for python-urllib3 fixes the following issue CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

openSUSE 16 Security Update : python-urllib3 (openSUSE-SU-2026:21430-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21430-1 advisory. This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can...

OPENSUSE-SU-2026:21430-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

SUSE-SU-2026:22937-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

K000162211: Python urllib3 vulnerability CVE-2026-21441

Security Advisory Description urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or...

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Impacturllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header e.g., gzip,...

PYSEC-2026-1996 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header e.g., gzip,...

PT-2026-56151

Name of the Vulnerable Software and Affected Versions Excelize versions prior to 2.11.0 Description The checkSheet function in github.com/xuri/excelize/v2 fails to validate the XML attribute value before using it as the length argument for a slice allocation in makexlsxRow, row. This lack of...

PT-2026-56158

Name of the Vulnerable Software and Affected Versions Excelize versions prior to 2.11.0 Description The streaming worksheet reader used by the Rows and GetRows functions does not enforce the TotalRows limit on the row r attribute. An attacker can provide a small XLSX file containing a row number...

CVE-2026-55967

AES-GCM encryption/decryption with extremely large cumulative single message sizes 64 GiB were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery...