CVE-2017-7529-

CVE-2017-7529-Nginx Range Header Integer Overflow Nginx is an open-source web server widely used as a high-performance web server, reverse proxy, cache server, and more. In Nginx versions up to 1.13.2, an integer overflow vulnerability exists that allows an attacker to manipulate the Range header...

CLEANSTART-2026-JT66111 Security fixes in velero-plugin-for-aws-fips 1.13.2-r1

Package velero-plugin-for-aws-fips version 1.13.2-r1 fixes 13 vulnerabilities: CVE-2026-39822, CVE-2026-42505, CVE-2026-33186, CVE-2026-25681, CVE-2026-27136...

CLEANSTART-2026-ON20634 Security fixes in velero-plugin-for-gcp-fips 1.13.2-r1

Package velero-plugin-for-gcp-fips version 1.13.2-r1 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-EI30490 Security fixes in grafana-alloy 1.13.2-r0

Package grafana-alloy version 1.13.2-r0 fixes 4 vulnerabilities: CVE-2026-26958, CVE-2026-25934, ghsa-fw7p-63qq-7hpr, ghsa-37cx-329c-33x3...

CLEANSTART-2026-LR68332 Security fixes in velero-plugin-for-aws 1.13.2-r2

Package velero-plugin-for-aws version 1.13.2-r2 fixes 5 vulnerabilities: CVE-2026-56852, CVE-2026-39822, CVE-2026-42505, ghsa-xmrv-pmrh-hhx2, CVE-2026-33186...

CLEANSTART-2026-AC75649 Security fixes in velero-plugin-for-gcp-fips 1.13.2-r2

Package velero-plugin-for-gcp-fips version 1.13.2-r2 fixes 5 vulnerabilities: CVE-2026-34986, CVE-2026-32283, CVE-2026-32281, ghsa-hfvc-g4fc-pqhx, ghsa-78h2-9frx-2jm8...

CLEANSTART-2026-BD64085 Security fixes in velero-fips 1.13.2-r0

Package velero-fips version 1.13.2-r0 fixes 1 vulnerabilities: ghsa-m5vv-6r4h-3vj9...

CLEANSTART-2026-SC97100 Security fixes for CVE-2026-25679, CVE-2026-27140, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283, CVE-2026-32289 applied in versions: 1.13.1-r1, 1.13.2-r0, 1.13.2-r1

Multiple security vulnerabilities affect the velero-plugin-for-microsoft-azure-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

Unauthenticated HTTP MCP browser-control surface in camofox-mcp Summary camofox-mcp exposed a Streamable HTTP MCP endpoint at /mcp with rate limiting but no inbound MCP-layer authentication. When HTTP mode was enabled, any client that could reach /mcp could list and invoke browser-control tools. ...

Axios HTTP/2 Session Cleanup State Corruption Vulnerability

Summary Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. This denial-of-service vulnerability affects axios versions prior to 1.13.2 when HTTP/2 is enabled. Details The vulnerability...

DEBIAN-CVE-2026-39865

Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability...

UBUNTU-CVE-2026-39865

Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability...

CVE-2026-39865

Axios HTTP/2 session cleanup state corruption in Http2Sessions.getSession() (lib/adapters/http.js) is fixed in 1.13.2. Prior to 1.13.2, the cleanup logic could corrupt state when removing sessions from the sessions array, allowing a malicious server to crash the client process via concurrent sess...

CVE-2026-39865

Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability...

PT-2026-31322

Name of the Vulnerable Software and Affected Versions Axios versions prior to 1.13.2 Description A flaw exists in the Axios HTTP/2 session cleanup logic, allowing a malicious server to crash the client process through concurrent session closures. The issue resides in the Http2Sessions.getSession...

CLEANSTART-2026-DQ17669 Security fixes for CVE-2026-24051, CVE-2026-25934, CVE-2026-26958, CVE-2026-32287, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, ghsa-37cx-329c-33x3, ghsa-6g7g-w4f8-9c9x, ghsa-fw7p-63qq-7hpr applied in versions: 1.13.2-r0, 1.14.1-r0, 1.14.1-r1

Multiple security vulnerabilities affect the grafana-alloy package. These issues are resolved in later releases. See references for individual vulnerability details...

SUSE CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the input.parsedpath field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes // as...

opa-envoy-plugin security vulnerabilities

opa-envoy-plugin is a plugin developed by Open Policy Agent. Versions of opa-envoy-plugin prior to 1.13.2-envoy-2 contained security vulnerabilities. These vulnerabilities stemmed from defects in the way the input.parsedpath field was constructed, which could lead to mismatches in path...

Security update for coredns (important)

openSUSE security update: security update for coredns ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20099-1 Rating: important References: bsc1239294 bsc1239728 bsc1249389 bsc1255345 bsc1256411 Cross-References: CVE-2024-51744 CVE-2025-58063...