SUSE CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

PT-2026-91824

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.1...

PT-2026-85803

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Non-Transparent Bridge ntb component where the original DMA address was not properly stored for future release. The DMA API requires that the dma free attrs functi...

PT-2026-86226

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the lowpaniphcmcastctxaddrcompress function in the net/6lowpan/iphc.c module of the Linux kernel’s networking functions is related to a single-shift error. Exploiting this vulnerability could allow an attacker to cause a system failure...

EUVD-2026-70598

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

CVE-2026-85242

PlaywrightCapture is vulnerable to a server-side request forgery (SSRF) in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL against localhost, loopback, and other non-public addresses, but redirects followed by aiohttp were...

CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

CVE-2026-78065

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user IDOR in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - editAddress redirected non-owners away only when the loaded address row had a non-empty userid belonging to someone else. Guest-checkout addres...

CVE-2026-78065 Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user IDOR in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - editAddress redirected non-owners away only when the loaded address row had a non-empty userid belonging to someone else. Guest-checkout addres...

CVE-2026-78065 Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user IDOR in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - editAddress redirected non-owners away only when the loaded address row had a non-empty userid belonging to someone else. Guest-checkout addres...

CVE-2026-78065

CVE-2026-78065 affects the J2Store Joomla extension (j2commerce.com), versions 1.0.0–3.3.21 , 4.0.0–4.0.21 , and 4.1.0–4.1.6 . The flaw is in the editAddress() function: its ownership check only redirected non-owners when the loaded address row had a non-empty user_id belonging to another user. S...

CVE-2026-85172 n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

SUSE CVE-2026-74278

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...

SUSE CVE-2026-74339

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read sndseqread copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRVSEQEXTCHAINED internally, and data.ext.ptr...

Linux Distros Unpatched Vulnerability : CVE-2026-84358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof...

Mail: Email address spoofing via malformed RFC 2047 encoded-words

Summary Mail::Utilities.qvaluedecode and Mail::Utilities.bvaluedecode decoded only the first RFC 2047 encoded-word in a string and used an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause the decoded...

MAL-2026-15823 Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...