K000163710: BIND vulnerability CVE-2026-10723

Security Advisory Description BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through...

K000163720: Apache Tomcat vulnerabilities CVE-2026-86243, CVE-2026-86246, and CVE-2026-86247

Security Advisory Description CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupporte...

K000163408: Out-of-band Security Notification (October 14, 2026)

Security Advisory Description On October 14, 2026, F5 announced the following security issues. This document is intended to serve as an index of these vulnerabilities to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. Article CVE|...

K000162617: NGINX Ingress Controller vulnerability CVE-2026-104939

Security Advisory Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper...

K000162613: NGINX ngx_http_v3_module vulnerability CVE-2026-95101

Security Advisory Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. CVE-2026-95101 Impact This vulnerability may...

K000162615: NGINX ngx_http_js_module vulnerability CVE-2026-101019

Security Advisory Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return...

K000162614: NGINX ngx_http_js_module vulnerability CVE-2026-101025

Security Advisory Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may sen...

K000162610: NGINX Gateway Fabric vulnerability CVE-2026-96615

Security Advisory Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and has an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticate...

K000162611: NGINX Ingress Controller vulnerability CVE-2026-94197

Security Advisory Description An authentication and authorization bypass vulnerability exists in F5 NGINX Ingress Controller when configured with the ExternalAuth policy or with Ingress external authentication. Client-supplied X-Forwarded-Prefix , X-Forwarded-URI , X-Original-URI , and...

K000162609: NGINX Gateway Fabric vulnerability CVE-2026-91184

Security Advisory Description NGINX Gateway Fabric has a vulnerability when it renders spec.basic.realm and spec.jwt.realm of a namespaced AuthenticationFilter Custom Resource Definition CRD verbatim, unescaped and unvalidated, into the shared data plane nginx.conf as authbasic "";. A namespaced...

K000162607: NGINX map directive and regex matching vulnerability CVE-2026-93479

Security Advisory Description A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result cou...

K000162606: NGINX ngx_http_ssl_module vulnerability CVE-2026-97629

Security Advisory Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared: : without an explicit sslsessionticketkey file directive to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a...

K000162608: NGINX ngx_http_core_module vulnerability CVE-2026-97205

Security Advisory Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing include virtual commands may trigger a Use-After-Free UAF...

K000162416: NGINX ngx_http_core_module vulnerability CVE-2026-15176

Security Advisory Description A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when...

K000163695: Overview of F5 Critical Releases

F5 Critical Releases are software updates delivered on a regular, predictable cadence that focus exclusively on security and bug fixes. Name change from Hardened Releases : F5 previously referred to these software updates as "Hardened Releases." We updated the name to Critical Releases to better...

K000163711: Podman vulnerability CVE-2025-9566

Security Advisory Description There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the...

K000163708: rust-openssl vulnerability CVE-2026-45784

Security Advisory Description rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipherupdateinplace in openssl/src/cipherctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers...

K000163699: OpenSSL vulnerability CVE-2026-75803

Security Advisory Description Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on ...

K000163698: OpenSSL vulnerability CVE-2026-63075

Security Advisory Description Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer...

K000163697: OpenSSL vulnerability CVE-2026-63076

Security Advisory Description Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then...

K000163690: Apache Tomcat vulnerabilities CVE-2026-78437, CVE-2026-86248, and CVE-2026-87022

Security Advisory Description CVE-2026-78437 Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, fro...

K000163682: Perl vulnerability CVE-2026-8376

Security Advisory Description Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perlstudychunk in regcompstudy.c checked the size of the joined...

K000163681: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2025-61662 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invokin...

K000163675: libssh vulnerability CVE-2026-59848

Security Advisory Description A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. CVE-2026-59848 Impact An attacker could cause SFTP client...

K000163669: libbsd vulnerability CVE-2019-20367

Security Advisory Description nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table strtab. CVE-2019-20367 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development...

K000163668: Go vulnerability CVE-2024-9341

Security Advisory Description A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system int...

K000163667: libssh vulnerability CVE-2026-59842

Security Advisory Description A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated...

K000163660: Next.js vulnerability GHSA-2xp9-vwfh-vxw4

Security Advisory Description A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled. GHSA-2xp9-vwfh-vxw4 Impact...

K000163661: libheif vulnerability GHSA-g89c-p67h-r497

Security Advisory Description A crafted HEIC/HEIF/AVIF file with nested identity-derivation iden and auxiliary auxl item references causes HeifPixelImage::scalenearestneighbor to write 16-bit samples into an 8-bit Alpha plane allocation, producing a heap buffer overflow OOB write. The overflow si...

K000163659: Next.js vulnerability CVE-2026-75604

Security Advisory Description Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route...

K000163654: GLib vulnerabilities CVE-2026-1484 and CVE-2026-1489

Security Advisory Description CVE-2026-1484 A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocat...

K000163653: Apache HTTP Server vulnerabilities CVE-2026-56449 and CVE-2026-57941

Security Advisory Description CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's modhttp2 via...

K000163638: Linux kernel vulnerability CVE-2026-46181

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4srqevent Sashiko points out the radixtree itself is RCU safe, but nothing ever frees the mlx4srq struct with RCU, and it isn't even accessed within the RCU critic...

K000163640: Apache Struts vulnerabilities CVE-2026-104711, CVE-2026-104712, CVE-2026-104713, and CVE-2026-104714

Security Advisory Description CVE-2026-104711 Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject...

K000163632: Mbed TLS vulnerability CVE-2026-34875

Security Advisory Description An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0. A buffer overflow can occur in public key export for FFDH keys. CVE-2026-34875 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Produc...

K000163631: Mbed TLS vulnerability CVE-2026-34876

Security Advisory Description An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtlsccmfinish in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized taglen parameter. This is...

K000163628: Apache Camel vulnerability CVE-2026-40473

Security Advisory Description The camel-mina component's MinaConverter.toObjectInputIoBuffer type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and reques...

K000163627: Linux kernel vulnerabilities CVE-2026-43276, CVE-2026-43329, CVE-2026-45898 and CVE-2026-46090

Security Advisory Description CVE-2026-43276 In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroyworkqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When...

K000163626: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2026-46242 In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix epremove struct eventpoll / struct file UAF epremove via epremovefile cleared file-fep under file-flock but then kept using @file inside the critical section isfileepoll...

K000163625: Arm CPU vulnerability CVE-2025-10263

Security Advisory Description Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned b...

K000163624: Python vulnerability CVE-2026-8643

Security Advisory Description pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory. CVE-2026-8643 Impact There is no...

K000163623: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2026-46113 In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp-gfn plus the SPTE index. This assumption breaks for shado...

K000163618: Linux kernel vulnerability CVE-2025-68366

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbdgenlconnect There is one use-after-free warning when running NBDCMDCONNECT and NBDCLEARSOCK: nbdgenlconnect nbdallocandinitconfig // configrefs=1 nbdstartdevice //...

K000163617: OpenSSL vulnerabilities CVE-2026-63072, CVE-2026-63073 and CVE-2026-63074

Security Advisory Description CVE-2026-63072 Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap writ...

K000163622: Python vulnerability CVE-2026-7210

Security Advisory Description xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and...

K000163620: Linux Kernel vulnerabilities CVE-2026-23112 and CVE-2026-43493

Security Advisory Description CVE-2026-23112 In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmettcpbuildpduiovec nvmettcpbuildpduiovec could walk past cmd-req.sg when a PDU length or offset exceeds sgcnt and then use bogus sg-length/offset...

K000163608: Python vulnerability CVE-2026-0994

Security Advisory Description A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal...

K000163606: Apache Tomcat vulnerability CVE-2026-78383

Security Advisory Description Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1...

K000163605: OpenSSH vulnerabilities CVE-2026-73281, CVE-2026-73282, and CVE-2026-73283

Security Advisory Description CVE-2026-73281 In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected]...

K000163593: GnuTLS vulnerability CVE-2026-42009

Security Advisory Description A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security DTLS packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with...