CVE-2026-86565

A flaw exists in DPDK lib/vhost where a guest can desynchronize the virtqueue size from the inflight descriptor table size . This discrepancy results in an out-of-bounds write within the host vhost process. No mitigation is currently available. Exploitation details are not provided in the documen...

kiboit phastpress server-side request forgeing vulnerability

Kiboit Phastpress versions 3.10 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from the scripts service endpoint dynamically constructing URL whitelists based on HTTP host headers controlled by attackers. Unauthenticated attackers can forge these headers t...

Eclipse Jetty input validation error vulnerability

Security vulnerabilities exist in Eclipse Jetty versions 12.1.11 and earlier within the 12.1.x series, as well as versions 12.0.38 and earlier within the 12.0.x series. Additionally, vulnerabilities are present in Eclipse Jetty jetty-proxy versions 11.0.32 and earlier within the 11.0.x series,...

Vulnerability related to encryption issues in Apache Airflow SSH provider

Versions prior to 7.0.0 of the Apache Airflow SSH provider and versions prior to 7.0.0 of the Apache Airflow SFTP provider contain an encryption vulnerability. This vulnerability arises because SSH host key validation is disabled by default; when no hostkey is configured or nohostkeycheck is...

EUVD-2026-101291

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKERARGS an...

CVE-2026-86002 Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKERARGS an...

CVE-2026-86002 Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKERARGS an...

CVE-2026-86002 Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKERARGS an...

CVE-2026-86856

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption. Mitigation Avoid using the nfp vDPA driver in production until patched. Do not attach untrusted...

CVE-2026-86561

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption...

CVE-2026-86561 Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption...

CVE-2026-86561 Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption...

CVE-2026-86561

A flaw exists in DPDK lib/vhost where memory size is not adequately validated before the mmap operation during vhost memory-region setup. This vulnerability, categorized under CWE-770 , can lead to memory corruption or a host crash . No mitigation is currently available. No information regarding ...

EUVD-2026-101307

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption...

CVE-2026-86561

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption. Mitigation No mitigation is currently available...

CVE-2026-86565

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. Mitigation No mitigation is currently available...

CVE-2026-73802

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to...

EUVD-2026-101142

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...