CVE-2026-8030

CVE-2026-8030 is a Missing Authorization vulnerability in GitLab CE/EE affecting versions 13.0 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1 . The root cause is improper validation of group URL slugs during namespace transfers , which under certain conditions allowed an authenticat...

EUVD-2026-80119

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-84997: Loop with Unreachable Exit Condition

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every...

PT-2026-93758

Name of the Vulnerable Software and Affected Versions react/http versions 0.6.0 through 1.11.0 Description A denial of service issue exists where a malformed HTTP message using Transfer-Encoding: chunked can cause the ReactHttpIoChunkedDecoder to enter an infinite loop. This occurs because the...

CVE-2026-92582: Cross-Site Request Forgery (CSRF)

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

Linux Distros Unpatched Vulnerability : CVE-2024-14029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a...

CVE-2026-20194: Incorrect Resource Transfer Between Spheres

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

PT-2026-93741

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1 Description In a secondary zone wher...

CVE-2026-19033: Acceptance of Extraneous Untrusted Data With Trusted Data

For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to ...

CVE-2026-78301: Acceptance of Extraneous Untrusted Data With Trusted Data

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

CVE-2026-19033: Acceptance of Extraneous Untrusted Data With Trusted Data

For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to ...

PT-2026-94099

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 commit e01e41ecc Description Cross-site request forgery occurs because the endpoint 'objects/videoAddNew.json.php' disables the automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check...

CVE-2026-90015: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...

Linux Distros Unpatched Vulnerability : CVE-2026-19033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG...

PT-2026-93260

A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request finished/MoRIIOConnectorWorker.get finished/MoRIIOWrapper. handle release message of the file vllm/distributed/kv transfer/kv connector/v1/moriio/moriio connector.py of the...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP message parsing process. An attacker can bypass intermediary access controls, poison caches, or cause victim requests to be joined with attacker-controlled prefixes by sending requests containing both...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP message parsing process. An attacker can bypass intermediary access controls, poison caches, or cause victim requests to be joined with attacker-controlled prefixes by sending requests containing both...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP message parsing process. An attacker can bypass intermediary access controls, poison caches, or cause victim requests to be joined with attacker-controlled prefixes by sending requests containing both...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...