CVE-2026-39910

creationtimestamp| type| source ---|---|--- 2026-06-08 19:43:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsgt6ropt23 2026-06-22 01:02:05+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3motoshdiat2m...

CVE-2026-11393

creationtimestamp| type| source ---|---|--- 2026-06-08 19:35:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsgig75ae2a 2026-06-08 20:02:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnshvnuq3g2y 2026-07-29 16:50:06+00:00| seen|...

GHSA-H9RH-5FFH-H669 vulnerabilities

Vulnerabilities for packages: gdal...

CVE-2026-46484

Summary: Headplane (a Web UI for Headscale) had a path traversal and authorization bypass vulnerability in the Headscale API client used during node and user rename operations. Affected versions and patch: the issue affects Headplane prior to 0.6.3 and 0.7.0-beta.3; it has been patched in 0.6.3 a...

CVE-2026-11393

Affected software: AgentCore CLI (v0.14.2 fix). Vulnerable path: Python code generation in AgentCore CLI before v0.14.2. Root cause: improper neutralization of triple-quote characters during code generation, enabling an authenticated remote actor to run arbitrary code. Impact: potential execution...

CVE-2026-11686

creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260616...

CVE-2026-11649

creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260616...

CVE-2026-11700

creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 01:20:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnszqwofd32p 2026-06-09 04:00:27+00:00| seen|...

Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

Summary Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a...

CVE-2026-49756

creationtimestamp| type| source ---|---|--- 2026-06-08 17:34:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns7prs24r2y 2026-07-29 16:35:07+00:00| published-proof-of-concept| https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m...

DEBIAN-CVE-2026-46290

In the Linux kernel, the following vulnerability has been resolved: x86/efi: Fix graceful fault handling after FPU softirq changes Since commit d02198550423 "x86/fpu: Improve crypto performance by making kernel-mode FPU reliably usable in softirqs", kernelfpubegin calls fpregslock which uses...

UBUNTU-CVE-2026-46306

In the Linux kernel, the following vulnerability has been resolved: flowdissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression PFC is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow...

CVE-2026-46443

creationtimestamp| type| source ---|---|--- 2026-06-08 17:07:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns6aiwzkq23...

CVE-2026-46656

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized...

CVE-2026-7186

creationtimestamp| type| source ---|---|--- 2026-06-08 15:54:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns24udqm22y...

CVE-2026-46310

In the Linux kernel, the following vulnerability has been resolved: media: renesas: vsp1: Fix NULL pointer deref on module unload When unloading the module on gen 4, we hit a NULL pointer dereference. This is caused by the cleanup code calling vsp1drmcleanup where it should be calling...

CVE-2026-46309 drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise

In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject cohnone PAT index for CPU cached memory in madvise Add validation in xevmmadviseioctl to reject PAT indices with XECOHNONE coherency mode when applied to CPU cached memory. Using cohnone with CPU cached buffer...

CVE-2026-49232

creationtimestamp| type| source ---|---|--- 2026-06-08 15:49:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrztvspks2q...

CVE-2026-46307

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: The ath5k driver seems to do an array-index-out-of-bounds access as shown by the UBSAN kernel message: UBSAN: array-index-out-of-bounds in...

CVE-2026-46298

In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix race with interrupt handler While executing -ioctl handler or -release handler, if an interrupt fires on the same cpu, then we can enter into a deadlock. This patch fixes both these handlers to take...