CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass

FreeRDP before 3.29.0 affected versions = 3.28.0 contains multiple TLS certificate identity validation weaknesses in tlsverifycertificate, tlsmatchhostname, and x509utilsgetdnsnames. Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware...

CVE-2026-55768

GoAccess (WebSocket server) before version 1.11 is affected by a vulnerability where a 64‑bit extended frame length is truncated to a signed 32‑bit WSFrame.payloadlen before max frame size is enforced. This allows an unauthenticated remote client to trigger an extremely large allocation (~18 exab...

JLSEC-2026-1058 ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or...

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries...

CVE-2026-52791

A flaw was found in fuse-overlayfs, a component used for rootless containers. This vulnerability allows a low-privileged process to retain SUID Set User ID and SGID Set Group ID permissions on files after they are truncated or opened with the OTRUNC flag. This can enable a local attacker to...

CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

EUVD-2026-50403

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-58158

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

CVE-2026-58155

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

CVE-2026-58158 Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

EUVD-2026-50211

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

CVE-2026-58158

Apache Traffic Server vulnerable to PROXY protocol parsing issues causing port truncation and a stack overflow. Affected under_versions: 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Upgrading to 9.2.15 or 10.1.4 mitigates the issue. CVSS metrics are provided by Apache: CVSS 3.1 base score 5.9 (N...

CVE-2026-58158 Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

CVE-2026-58158

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

CVE-2026-58158

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the...

CVE-2026-58155

Apache Traffic Server is affected by CVE-2026-58155 due to header-name length truncation that can enable header aliasing, request smuggling, and policy bypass. Affected versions are 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Upgrading to 9.2.15 or 10.1.4 is recommended to fix the issue. The pr...

EUVD-2026-50209

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

CVE-2026-58155

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

CVE-2026-58155 Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

CVE-2026-58155 Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...