net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

Linux Distros Unpatched Vulnerability : CVE-2026-80682

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: riscv/mm: use physical alignment for vmemmapstartpfn RISC-V computes vmemmapstartpfn by...

PT-2026-83973

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

CVE-2026-81267: User Interface (UI) Misrepresentation of Critical Information

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

CVE-2026-81499

GHSA-6v6x-387m-rj4w: Project restriction bypass on network address sets...

PT-2026-83972

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A memory leak occurs in the net ipv6 send ns function within subsys/net/ip/ipv6 nbr.c when allocating a transmit net pkt for a Neighbor Solicitation. If the...

Security Vulnerabilities fixed in Firefox for iOS 155.0 — Mozilla

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content...

UBUNTU-CVE-2026-81499

GHSA-6v6x-387m-rj4w: Project restriction bypass on network address sets...

Linux Distros Unpatched Vulnerability : CVE-2026-81499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - GHSA-6v6x-387m-rj4w: Project restriction bypass on network address sets CVE-2026-81499 Note that Nessus relies on the presence of the package as...

Linux Distros Unpatched Vulnerability : CVE-2026-80592

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range parameters are invalid The comment on top o...

CVE-2026-82648 WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address

WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud...

CVE-2026-82638

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

CVE-2026-82638 jina-ai reader Server-Side Request Forgery via disabled private-address guard

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

CVE-2026-82638 jina-ai reader Server-Side Request Forgery via disabled private-address guard

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

EUVD-2026-68214

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

CVE-2026-82638

jina-ai reader disables its private-address guard outside Google Cloud deployments, creating a Server-Side Request Forgery (SSRF) vulnerability. The root cause lies in conditional logic (referenced in src/services/misc.ts) that only enforces the guard on GCP, leaving other environments exposed. A...

CVE-2026-82638

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

CVE-2026-82638 jina-ai reader Server-Side Request Forgery via disabled private-address guard

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

PT-2026-83558

Name of the Vulnerable Software and Affected Versions jina-ai reader affected versions not specified Description The software disables its private-address guard when deployed outside of Google Cloud environments, which enables unauthenticated attackers to perform server-side request forgery SSRF...

fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...