github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers

A flaw was found in quic-go, an implementation of the QUIC protocol in Go. A remote attacker can exploit this by sending specially crafted HTTP/3 trailer fields. This can cause the system to allocate excessive memory, leading to a denial-of-service DoS condition where the affected server or clien...

CVE-2026-62378

creationtimestamp| type| source ---|---|--- 2026-07-15 17:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqpbjey2z52o 2026-07-15 18:00:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpcg2jm3y2e 2026-07-15 19:12:44+00:00| seen|...

CVE-2026-42533

creationtimestamp| type| source ---|---|--- 2026-07-15 15:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp35imbr32a 2026-07-15 16:49:36+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116925017337379554 2026-07-15 17:32:31+00:00| seen|...

JLSEC-2026-761

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of message...

July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days

Just one month ago, June 2026 Patch Tuesday broke Microsoft’s previous record with 206 CVEs and three zero‑days. July now triples that count, reinforcing that the era of “small” Patch Tuesdays may be over as AI‑driven vulnerability discovery ramps up. The update includes 59 critical...

SUSE-SU-2026:3043-1 Security update for curl

This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. - CVE-2026-8458: wrong reuse for different services bsc1268407. - CVE-2026-8924: traling dot domain super cookie bsc1268409. - CVE-2026-8927: env-set cross-proxy Digest auth state leak...

Important: Red Hat Security Advisory: python3.9 security, bug fix, and enhancement update

An update for python3.9 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

RHSA-2026:39320 Red Hat Security Advisory: python3 security update

Bulletin has no description...

RHSA-2026:39183 Red Hat Security Advisory: python3.12 security update

Bulletin has no description...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

BIT-PILLOW-2026-59198 Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0...

BIT-MODSECURITY2-2026-52747 ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and...

SUSE-SU-2026:3004-1 Security update for openssl-3

This update for openssl-3 fixes the following issue - CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption bsc1266350...

PT-2026-60303

Name of the Vulnerable Software and Affected Versions Tenda AC10 v3 version V03.03.16.09 Description A buffer overflow allows attackers to cause a permanent Denial of Service DoS or potentially execute remote code. This issue occurs via the '/cgi-bin/UploadCfg' endpoint. There have been reports o...

Oracle Linux 10 : python3.12 (ELSA-2026-19064)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19064 advisory. - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 -...

ALSA-2026:39893 Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:39771 Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Security update for nasm (low)

openSUSE security update: security update for nasm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21333-1 Rating: low References: bsc1261985 bsc1261986 Cross-References: CVE-2026-6067 CVE-2026-6068 CVSS scores: CVE-2026-6067 SUSE : 3.3...

PT-2026-60213

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.17 Description When Signup and CreateUserDir are both set to true, the software uses the cleanUsername function to build new user scopes. A many-to-one normalization flaw allows different usernames for...

CVE-2026-30618

CVE-2026-30618 affects xszyou Fay 4.3.1, where the MCP STDIO server management and command execution handling can be abused via a publicly exposed MCP management interface to execute arbitrary commands in the Fay service context. Technical details across sources describe an RCE via attacker-contr...