JLSEC-2026-783

A flaw was found in libssh in which a malicious SFTP SSH File Transfer Protocol server can exploit this by sending a malformed 'longname' field within an SSHFXPNAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can...

Security update for wget

This update for wget fixes the following issues: CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. CVE-2026-58470:...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker who convinced a user to perform certain UI gestures to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-64161

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description Progress MOVEit Transfer contains a permissive cross-domain security policy that allows interaction with untrusted domains. This...

The vulnerability of the Local Mail Transfer Protocol (LMTP) used by Dovecot and OX Dovecot Pro mail servers, which is related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Local Mail Transfer Protocol LMTP used by Dovecot and OX Dovecot Pro mail servers involves an uncontrolled consumption of resources. Exploiting this vulnerability allows a malicious actor to cause service failures...

PT-2026-64162

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description Progress MOVEit Transfer contains an issue where sessions do not expire sufficiently, which could allow unauthorized access to active...

PT-2026-64158

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description An improper authentication issue exists in Progress MOVEit Transfer, which may allow an attacker to bypass authentication mechanisms...

PT-2026-64163

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description Progress MOVEit Transfer contains an issue involving improper neutralization of input during web page generation, which leads to cross-si...

GHSA-Q4F6-JM68-57WW Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Impact HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained...

SUSE CVE-2026-15370

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-40712

CVE-2026-40712 affects Dell PowerProtect Data Manager prior to 20.2.0.0. The vulnerability is an Improper Input Validation in the REST API that could allow a high-privileged, remote attacker to achieve elevation of privileges. Exploitation details are not provided in the documents; remediation de...

CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

ALPINE-CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

EUVD-2026-47674

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

CVE-2026-50248

CVE-2026-50248 affects NLnet Labs Unbound 1.7.0 through 1.25.1. When an auth/rpz zone has a configured primary hostname that resolves to a bogus A/AAAA, it can still be treated as a possible XFR endpoint. A malicious actor who can spoof the hostname’s A/AAAA (no valid RRSIG required) may become t...

CVE-2026-50248 BOGUS configured primary hostname accepted for XFR in auth/rpz zones

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...