CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...

CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...

CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...

CVE-2026-86478

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...

CVE-2026-86478

JetBrains YouTrack is vulnerable to an improper authentication flaw in the YouTrack Helpdesk component prior to versions 2025.3.161254 and 2026.1.14042 . The vulnerability allows an unauthenticated attacker to perform account takeover by supplying a self-asserted email address, effectively bypass...

CLSA-2026-1788790498 TuxCare security update for ip-address (2 CVEs)

TuxCare rebuilt ip-address to address 2 CVEs. Fixed in 6.4.0-tuxcare.2...

WordPress Contact Form by Supsystic plugin <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header vulnerability

Unauthenticated Stored Cross-Site Scripting via IP Address Header vulnerability discovered by andrea bocchetti in WordPress Plugin Contact Form by Supsystic versions = 1.10.2...

libbpf:bpf-object-fuzzer: Heap-use-after-free in btf_ext_parse_sec_info

Project: https://github.com/libbpf/libbpf.git Detailed Report: https://oss-fuzz.com/testcase?key=4722152942403584 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzerasani386libbpf Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

PT-2026-95039

TuxCare rebuilt ip-address to address 2 CVEs. Fixed in 6.4.0-tuxcare.2...

CVE-2026-86478: Authentication Bypass by Spoofing

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address...

PT-2026-86927

Server-Side Request Forgery SSRF vulnerability in ash-project ash authentication oauth2 server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. public ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces th...

Exploit for Use After Free in Linux Linux_Kernel

PS7716.5665N Hazel Fire TV temporary root Temporary root expl...

CVE-2026-18480 SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053236)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053236 advisory. In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipcudpaddr2str on error tipcudpaddr2str should return non-zero...

CVE-2026-18480: Improper Privilege Management

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053215)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053215 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdmaaddrcancel happens before issuing more requests The FSM can run in a circle...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053398)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053398 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missi...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053424)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053424 advisory. In the Linux kernel, the following vulnerability has been resolved: tcpmetrics: validate source addr length I don't see anything checking that TCPMETRICSATTRSADDRIPV...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073370)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073370 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5399104239501312 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...