CLEANSTART-2026-VW61605 Security fixes in nats-streaming 0.24.6-r3

Package nats-streaming version 0.24.6-r3 fixes 2 vulnerabilities: CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-IF83515 Security fixes in nats-streaming 0.25.6-r3

Package nats-streaming version 0.25.6-r3 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-TN85726 Security fixes in nats-streaming 0.25.6-r4

Package nats-streaming version 0.25.6-r4 fixes 2 vulnerabilities: CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-NU09450 Security fixes in nats-streaming 0.24.6-r2

Package nats-streaming version 0.24.6-r2 fixes 1 vulnerabilities: CVE-2026-42504...

EUVD-2026-50449

The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger...

PT-2026-65943

Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...

SUSE-SU-2026:3397-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

SUSE SLES16 Security Update : python-urllib3 (SUSE-SU-2026:22863-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22863-1 advisory. This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli...

RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2026:47069)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:47069 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package...

CVE-2026-64465

The CVE-2026-64465 issue affects the Linux kernel USB xHCI driver. A sleep-prone path existed when freeing large stream context arrays: xhci_free_streams() called xhci_free_stream_ctx() via dma_free_coherent() while holding a lock with interrupts disabled, which can sleep and trigger a BUG in ato...

openSUSE 16 Security Update : python-urllib3 (openSUSE-SU-2026:21430-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21430-1 advisory. This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can...

PT-2026-64441

Summary Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the...

EUVD-2026-40626

Ruby json: JSON generator heap buffer overflow when streaming to an IO...

Ruby json: JSON generator heap buffer overflow when streaming to an IO

Summary JSON.dumpobj, io and JSON::Stategenerateobj, io can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash /...

Security update for python-urllib3

This update for python-urllib3 fixes the following issues: CVE-2025-66471: excessive resource consumption via decompression of highly compressed data in Streaming API bsc1254867. CVE-2025-66418: resource exhaustion via unbounded number of links in the decompression chain bsc1254866. Patch...

SUSE-SU-2026:0367-2 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2025-66471: excessive resource consumption via decompression of highly compressed data in Streaming API bsc1254867. - CVE-2025-66418: resource exhaustion via unbounded number of links in the decompression chain bsc1254866...

PYSEC-2026-3520 PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI recipe.runstream skips dangerous-tool policy enforcement Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allowdangeroustools=True. The normal recipe.run path enforces this with checktoolpolicy. The streaming path,...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Cast Streaming in Google Chrome before version 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code via malicious network traffic. Chromium security severity: Critical...

OPENSUSE-SU-2026:21430-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

SUSE-SU-2026:22863-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...