CVE-2026-80885 afs: Fix uncancelled rxrpc OOB message handler

In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing typically to respond to security challenges. Also move OOB message processing to afswq so that it's also waited for and make the OOB...

EUVD-2026-71515

In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing typically to respond to security challenges. Also move OOB message processing to afswq so that it's also waited for and make the OOB...

CVE-2026-80885

CVE-2026-80885 affects the AFS (Andrew File System) subsystem in the Linux kernel . The vulnerability involves an uncancelled rxrpc out-of-band (OOB) message handler , which is typically used to respond to security challenges. If the OOB handler is not properly cancelled, it may continue processi...

CVE-2026-80885 afs: Fix uncancelled rxrpc OOB message handler

In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing typically to respond to security challenges. Also move OOB message processing to afswq so that it's also waited for and make the OOB...

CVE-2026-80885

In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processing typically to respond to security challenges. Also move OOB message processing to afswq so that it's also waited for and make the OOB...

CVE-2026-85673

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without...

CVE-2026-80772 HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joyconctlrreadhandler joyconctlrreadhandler casts an incoming HID input report to struct joyconinputreport and parses it, guarding the cast only with a 12-byte length check: if size = 12 /...

CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

CVE-2026-85673 LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without...

CVE-2026-85673

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without...

CVE-2026-85673 LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without...

CVE-2026-85673

LLaMA-Factory contains a server-side request forgery (SSRF) vulnerability in its OpenAI-compatible API multimodal media URL handler . The root cause is that the check_ssrf_url guard validates a URL only once, while requests.get subsequently follows HTTP redirects and re-resolves DNS without re-va...

CVE-2026-85673 LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without...

CVE-2026-85622

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership in the establish_ws_connection_v2 WebSocket handler. This allows any authenticated user to bind a session to a workspace they do not belong to, then send sync Manifest messages with victim object identifiers to read full documen...

CVE-2026-85514

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be...

CVE-2026-74236

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlinkoremailfile function accepts parameters prefixed with vfilerow and appends their values directly to a base directory path without sanitizing for directory traversal...

CVE-2026-74235

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcfhandledownload function accepts parameters prefixed with vdel and appends their values directly to the base configuration directory path without...

CVE-2026-85514

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be...

EUVD-2026-71088

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be...