PT-2026-103313

🚨 CVE-2026-100266 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address 🎖@cveNotify...

PT-2026-103048

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services...

CVE-2026-47567: Uncontrolled Resource Consumption

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumption by exhausting the DRM VMA offset address space. A successful exploit of this vulnerability might lead to denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-102312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788960930)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788960930 advisory. - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778129970)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778129970 advisory. - During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the...

PT-2026-103415

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumption by exhausting the DRM VMA offset address space. A successful exploit of this vulnerability might lead to denial of service...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788960930)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788960930 advisory. - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter...

AlmaLinux 9.2 [TuxCare] Security Update: compat-openssl11 (ALMALINUX9.2:CLSA-2025:1764692769)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764692769 advisory. - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an...

Linux Distros Unpatched Vulnerability : CVE-2026-100820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4,...

NPM: ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

NPM: ip-address: isInSubnet and isHostInSubnet compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range vulnerability discovered by ? in WordPress Npm ip-address versions = 10.7.0...

GHSA-J6R3-76F7-8JCV ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

Summary isInSubnet and isHostInSubnet accept an address of either family and compare masked binary strings without checking that both operands are the same family. Address4 pads to 32 bits and Address6 to 128, so whenever the leading bits agree the strings are equal: new...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101912 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101912 Source advisory: OSV:GHSA-J6R3-76F7-8JCV...

NPM: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

NPM: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process vulnerability discovered by ? in WordPress Npm ip-address versions = 10.7.0...

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

Summary new Address6 and Address6.isValid place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte , so the work and the memory scale with the inpu...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101911 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101911 Source advisory: OSV:GHSA-H3MG-XC3C-68PW...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101911 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101911 Source advisory: GHSA-H3MG-XC3C-68PW...

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...

GHSA-G57G-F23G-4646 Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...

SUSE CVE-2026-100820

Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...