CVE-2026-54166 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

CVE-2026-89527

A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when a listener creation fails, leading to an improper release of a network namespace reference. This resource leak can be exploited by a local attacker, potentially causing a denial of service DoS by exhausting syst...

EUVD-2026-38207

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover...

DEBIAN-CVE-2026-80983

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-80979

In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...

UBUNTU-CVE-2026-89563

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

UBUNTU-CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

EUVD-2026-76320

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipastartxmit unconditionally stops the TX queue before calling pmruntimeget, relying on the wake scheduled by runtime resume ipamodemwakequeuework to restart it once power...

CVE-2026-80992 net: ravb: avoid dereferencing an invalid PTP clock

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

EUVD-2026-76306

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

EUVD-2026-76247

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

[SECURITY] Fedora 45 Update: nss-3.127.0-1.fc45

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

[SECURITY] Fedora 45 Update: mrtg-2.17.10-15.fc45

The Multi Router Traffic Grapher MRTG is a tool to monitor the traffic load on network-links. MRTG generates HTML pages containing PNG images which provide a LIVE visual representation of this traffic...

CVE-2026-84195

A flaw was found in Kyverno, a policy engine for Kubernetes. This vulnerability allows attackers with low privileges to exfiltrate the admission controller's ServiceAccount token. By directing apiCall requests to external or attacker-controlled endpoints, the token is automatically attached witho...

SUSE CVE-2026-88018

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-70341

Use after free in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...

EUVD-2026-76143

Use after free in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...

CVE-2026-70341

CVE-2026-70341 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows an authorized attacker to achieve remote code execution over a network. Microsoft assigned a CVSS 3.1 base score of 8.5 (HIGH) with a changed scope, reflecting high impact to confidentiality, integrity...

CVE-2026-86321

A flaw was found in jackson-coreutils. This server-side request forgery SSRF vulnerability occurs when applications use the JsonLoader.fromURL function with untrusted input. A remote attacker can exploit this to induce the server to make arbitrary requests. This could lead to unauthorized...