CVE-2026-74648: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

PT-2026-79689

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference can occur in the tap get user xdp function. This happens when the vhost TX path provides an XDP buffer with a GSO virtio-net header and the protocol is...

CVE-2026-74684: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74684: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

Linux Distros Unpatched Vulnerability : CVE-2026-74684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 net: tap: NULL pointer derefence in devparseheaderprotocol when...

Linux Distros Unpatched Vulnerability : CVE-2026-43971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in...

PT-2026-79673

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tpacket snd function where dev-hard header len is read independently during skb allocation and header construction within tpacket fill skb. Concurrent netdevice...

CVE-2026-74704: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON1 which can...

Linux Distros Unpatched Vulnerability : CVE-2026-74701

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided...

Linux Distros Unpatched Vulnerability : CVE-2026-74705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udp: fix potential use-after-free in tunnel segmentation skbudptunnelsegment gets the UDP header before ensuring the tunnel header is in the skb head. If the pu...

CVE-2026-62316

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

Cross-site Scripting (XSS)

Overview yourls/yourls is an is a set of PHP scripts that allow you to run Your Own URL Shortener. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the processing of HTTP Referer headers in statistics chart rendering. An attacker can execute arbitrary JavaScript in...

GHSA-5H77-88J3-R659 YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Summary YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer...

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Summary YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer...

JLSEC-2026-1353 Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

Impact Wasmtime's implementation of the wasi:http/types.fields resource is susceptible to panics when too many fields are added to the set of headers. Wasmtime's implementation in the wasmtime-wasi-http crate is backed by a data structure which panics when it reaches excessive capacity and this...

CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...

CVE-2026-63135

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...

CVE-2026-63135

YOURLS (self-hosted PHP URL shortener) versions 1.5.1 through 1.10.4 are affected by a stored cross-site scripting (XSS) vulnerability in the referrer statistics chart. The root cause is that the chart builder concatenates referrer-derived domain labels into inline JavaScript without proper strin...

CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...

CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...