CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

CVE-2026-91164

Warpgate is an open-source SSH, HTTPS, and MySQL bastion host for Linux. In versions 0.23.0 through 0.27.2 , the HTTP API token authentication flow fails to enforce the owning user's allowed_ip_ranges against the trusted client address, as the token is resolved without that check in warpgate-prot...

CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

EUVD-2026-84060

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...

CVE-2026-17050

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

Malicious code in bnppf-flag-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 689227d0fdfe4abc108c7dfc5b5b97e752182a410265c141ca33161247619e78 The package ships poc.js and wires it to both preinstall and postinstall lifecycle hooks in package.json, so it runs automatically on npm install...

CVE-2026-17050 Double free of the USB host configuration descriptor when device enumeration fails

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

CVE-2026-17050

The Zephyr RTOS experimental USB host stack is vulnerable to a double free in the usb_device_heap when handling a malformed or malicious USB peripheral. Specifically, in usbh_device_set_configuration(), a buffer (udev->cfg_desc) is released via k_heap_free() on three specific failure paths, bu...

EUVD-2026-84012

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

CVE-2026-17050 Double free of the USB host configuration descriptor when device enumeration fails

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

CVE-2026-17050 Double free of the USB host configuration descriptor when device enumeration fails

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

EUVD-2026-84010

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

SUSE CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

K000163358: Moby vulnerability CVE-2026-42306

Security Advisory Description Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bin...