CVE-2026-44982 CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from maxr.ContentLength, 0, so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length...

CVE-2026-44982

CVE-2026-44982 affects CrowdSec AppSec. The bug in pkg/appsec/request.go NewParsedRequestFromRequest reads the body using max(r.ContentLength, 0), causing HTTP/1.1 chunked and HTTP/2 without Content-Length to appear with an empty body, bypassing body-inspection rules (REQUEST_BODY, BODY_ARGS, ARG...

CVE-2026-46515

creationtimestamp| type| source ---|---|--- 2026-07-16 19:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqryzl4r7q2c 2026-07-16 20:01:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrzocxj7w2m...

CVE-2026-15449

CVE-2026-15449 describes a TOCTOU vulnerability in the illumos data-link pseudo-driver (dld) regarding handling of DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. In drv_ioc_prop_common(), the header is read once to obtain pr_valsize, a kernel heap buffer is allocated, and then the fu...

CVE-2026-46512

creationtimestamp| type| source ---|---|--- 2026-07-16 18:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrvrushsg2x 2026-07-16 19:47:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqryvgoskh2u...

SUSE-SU-2026:22750-1 Security update for freetype2

This update for freetype2 fixes the following issues - Update to version 2.14.3 - CVE-2026-23865: Integer overflow in the ttvarloaditemvariationstore function bsc1259118. - CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TTGetVarDesign implementation used by...

Begun, the Patch Wars have

Welcome to this week's edition of the Threat Source newsletter. We all knew, to some degree or another, that this summer was going to a hot mess. I don't mean FIFA drama or record setting heat waves. I mean the slow but steady momentum that AI frontier models were accruing for vulnerability...

CVE-2026-45336

creationtimestamp| type| source ---|---|--- 2026-07-16 17:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrscyddbi2l 2026-07-16 19:25:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrxndfem52e...

CVE-2026-45568

creationtimestamp| type| source ---|---|--- 2026-07-16 17:42:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrruonqck2c 2026-07-16 18:39:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrv3zbe6o2l 2026-07-21 04:37:06+00:00| seen|...

CVE-2026-46687

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView$template, allowing an...

CVE-2026-45576

Summary: CVE-2026-45576 affects the zrok tool. From versions 0.4.23 through 2.0.3, the zrok2 copy command stores attacker-controlled WebDAV or zrok drive paths (e.g., /../outside.txt) in the source inventory and passes them to FilesystemTarget.WriteStream, enabling writing files outside the selec...

CVE-2026-44632

creationtimestamp| type| source ---|---|--- 2026-07-16 16:44:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqron2dykv25 2026-07-16 18:42:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrvbfj4ew2e 2026-07-18 05:07:06+00:00| seen|...

CVE-2026-51380

creationtimestamp| type| source ---|---|--- 2026-07-16 16:34:02+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116930618228870140 2026-07-16 16:40:28+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqroftqfcv2u...

CVE-2026-53598

Prompty is a markdown file format .prompty for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read...

CVE-2026-54733

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrn26pxli2a 2026-07-16 16:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrou4dsoi2o 2026-07-17 17:12:45+00:00| seen|...

CVE-2026-59865

creationtimestamp| type| source ---|---|--- 2026-07-16 16:00:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrm6qrdhu2u 2026-07-16 16:48:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrou5lqyq2o...

CVE-2026-59864

creationtimestamp| type| source ---|---|--- 2026-07-16 15:55:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrlwrdoo42s 2026-07-16 16:42:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrojfdglg2c...

CVE-2026-53598

The CVE-2026-53598 issue affects Prompty (.prompty) loaders that expanded ${file:...} references in frontmatter before 2.0.0-beta.2, allowing an attacker-controlled prompt to read local files via absolute paths, .. traversal, or symlink escapes. Root cause: path confinement was not enforced durin...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-35149

creationtimestamp| type| source ---|---|--- 2026-07-16 14:21:29+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqrgnylq7c2m 2026-07-16 15:00:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqriu5qsbd2x 2026-07-22 11:37:06+00:00| seen|...