CVE-2026-54649 punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

CVE-2026-65608

creationtimestamp| type| source ---|---|--- 2026-09-17 18:20:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvqbeptd2c2t 2026-09-17 18:35:22+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-c4wf-2xxc-68qm...

GHSA-VRF4-MX87-P53W

creationtimestamp| type| source ---|---|--- 2026-09-17 18:19:52+00:00| seen| https://bsky.app/profile/standup.thecompound.tech/post/3mvqbeba3dn2c 2026-09-17 19:31:30+00:00| seen| https://gist.github.com/alon710/2a63239df5d54f7447e1b660b93edce2...

FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure

A flaw was found in FreeRDP, an implementation of the Remote Desktop Protocol. A malicious RDP server can exploit an out-of-bounds read vulnerability by sending a malformed planar bitmap or surface update. This causes the client's decoder to read beyond its allocated buffer, which can lead to a...

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Summary Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI inline user:password@host credentials and does not inspect the query string. With IncludeQueryString enabled by...

GHSA-8PHW-XRJ9-CPQP Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Summary Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI inline user:password@host credentials and does not inspect the query string. With IncludeQueryString enabled by...

CVE-2026-28326

creationtimestamp| type| source ---|---|--- 2026-09-17 17:52:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i3uesu6gf6led 2026-09-17 21:18:54+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvqlef2zbp2x 2026-09-18 20:15:02+00:00| seen|...

CVE-2026-76834

creationtimestamp| type| source ---|---|--- 2026-09-17 17:30:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvq6lez25l2f 2026-09-17 18:09:44+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvqas4yzw52r...

CVE-2026-93174

In the Linux kernel, the following vulnerability has been resolved: bpf: Copy per-CPU map value padding in copymapvaluelong In kernel, per-CPU map elements are stored with roundupmap-valuesize, 8 bytes. On UAPI lookup paths, it copies the rounded size for each CPU into a temporary buffer. However...

AZL-102455 CVE-2026-93174 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Copy per-CPU map value padding in copymapvaluelong In kernel, per-CPU map elements are stored with roundupmap-valuesize, 8 bytes. On UAPI lookup paths, it copies the rounded size for each CPU into a temporary buffer. However...

DEBIAN-CVE-2026-93159

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a workdata structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng-priv and later...

CVE-2026-93159

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a workdata structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng-priv and later...

AZL-102479 CVE-2026-93159 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a workdata structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng-priv and later...

DEBIAN-CVE-2026-93120

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

AZL-102587 CVE-2026-93054 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd, the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, uioregisterdevice unwinds the device but leaves idev-info...

AZL-102750 CVE-2026-93052 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

CVE-2026-93054

In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd, the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, uioregisterdevice unwinds the device but leaves idev-info...

CVE-2026-92520

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

AZL-101903 CVE-2026-90307 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

DEBIAN-CVE-2026-90272

In the Linux kernel, the following vulnerability has been resolved: perf: armpmuv3: Zero initialize hwid branch stack field PERFSAMPLEBRANCHHWINDEX is supported by BRBE so hwid is passed to userspace, but it's never set by the BRBE driver. Zero initialize it as it should be according to the docs:...