CVE-2026-44909

CVE-2026-44909 – Normal mode Proxygen’s HTTP/2 flow-control handling in the core HTTP session layer lacks a generalized slow-consumer detection mechanism. A remote unauthenticated attacker can exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or by withholding WINDOW_UPDATE...

EUVD-2026-48295

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

JLSEC-2026-783

A flaw was found in libssh in which a malicious SFTP SSH File Transfer Protocol server can exploit this by sending a malformed 'longname' field within an SSHFXPNAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can...

Security update for wget

This update for wget fixes the following issues: CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. CVE-2026-58470:...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker who convinced a user to perform certain UI gestures to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security...

[SECURITY] Fedora 44 Update: libssh-0.12.1-1.fc44

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, trans fer files, use a secure and transparent tunnel for your remote...

[SECURITY] Fedora 43 Update: libssh-0.11.5-1.fc43

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, trans fer files, use a secure and transparent tunnel for your remote...

The vulnerability of the Local Mail Transfer Protocol (LMTP) used by Dovecot and OX Dovecot Pro mail servers, which is related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Local Mail Transfer Protocol LMTP used by Dovecot and OX Dovecot Pro mail servers involves an uncontrolled consumption of resources. Exploiting this vulnerability allows a malicious actor to cause service failures...

PT-2026-64162

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description Progress MOVEit Transfer contains an issue where sessions do not expire sufficiently, which could allow unauthorized access to active...

PT-2026-64161

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description Progress MOVEit Transfer contains a permissive cross-domain security policy that allows interaction with untrusted domains. This...

PT-2026-64158

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description An improper authentication issue exists in Progress MOVEit Transfer, which may allow an attacker to bypass authentication mechanisms...

PT-2026-64163

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description Progress MOVEit Transfer contains an issue involving improper neutralization of input during web page generation, which leads to cross-si...

NPM: n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

NPM: n8n: Shared Credential Header Leak via HTTP Request Pagination Expression vulnerability discovered by ? in WordPress Npm n8n versions 1.123.61...

GHSA-Q4F6-JM68-57WW Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Impact HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained...

SUSE CVE-2026-15370

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-40712

CVE-2026-40712 affects Dell PowerProtect Data Manager prior to 20.2.0.0. The vulnerability is an Improper Input Validation in the REST API that could allow a high-privileged, remote attacker to achieve elevation of privileges. Exploitation details are not provided in the documents; remediation de...

CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

ALPINE-CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...