SUSE CVE-2026-80680

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amdmp2registercb stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2caddadapter fails, probe returns and devres...

SUSE CVE-2026-80698

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices idxdconfwqrelease, idxdconfenginerelease, idxdconfgrouprelease each call kfree on the enclosing struct. The...

SUSE CVE-2026-80722

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

EUVD-2026-67816

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82285 BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82285

BISHENG (by dataelement ) through version 2.6.0-fix2 is affected by an unauthenticated Server-Side Request Forgery (SSRF) in the POST /api/v1/workflow/report/callback endpoint. The endpoint lacks authentication and applies no URL scheme restrictions or host filtering , allowing unauthenticated at...

CVE-2026-82285 BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82285

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82285 BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

CVE-2026-82274 Twenty Open Redirect via OAuth Propagator Callback

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

CVE-2026-82274 Twenty Open Redirect via OAuth Propagator Callback

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

EUVD-2026-67805

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

CVE-2026-82274

Twenty through version 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint. The root cause is that the state query parameter is treated as a redirect URL, allowing attackers to craft malicious requests that redirect users to arbitrary ho...

CVE-2026-82274 Twenty Open Redirect via OAuth Propagator Callback

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

CVE-2026-82273 Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

EUVD-2026-67804

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

CVE-2026-82273

Mastra through 1.63.0 contains an authentication bypass in the memory API thread ownership validation. When the mapUserToResourceId callback is omitted from configuration, the ownership check becomes a no-op, allowing any authenticated user to enumerate all threads via GET /api/memory/threads and...

CVE-2026-82273 Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...