CVE-2026-63626

Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complet...

CVE-2026-73260

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

CVE-2026-86848 Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend...

CVE-2026-86848 Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend...

CVE-2026-86848

A time-of-check/time-of-use (TOCTOU) vulnerability exists in DPDK lib/vhost vhost-crypto . The issue stems from the indirect-descriptor snapshot double-fetching a guest descriptor next index. This flaw allows a malicious guest to trigger an out-of-bounds access in the host backend. To mitigate th...

CVE-2026-78433

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...

CVE-2026-70406

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...

CVE-2026-67577

Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity...

CVE-2026-107381 svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...

CVE-2026-53613

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount2 path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. ...

CVE-2026-53612

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility's hookowner.c post-mount hook performs path-based chmod and lchown operations on a previously validated mount target. A local low-privileged user authorized by a...

EUVD-2026-101111

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...

CVE-2026-70406 Gitea private comparison disclosure with public-only tokens

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...

CVE-2026-70406

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...

CVE-2026-66874 Gitea required Actions check bypass through skipped workflows

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874 Gitea required Actions check bypass through skipped workflows

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

AZL-108146 CVE-2026-98405 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...