GHSA-9WJQ-CP2P-HRGF Loofah: SVG `href` attribute bypasses local-reference restriction

Summary Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it,...

Server-side Request Forgery (SSRF)

Overview code.gitea.io/gitea/services/migrations is a painless self-hosted Git Service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access...

CVE-2026-63934

A flaw was found in the Linux kernel's iioitg3200 gyroscope driver. An incorrect I2C Inter-Integrated Circuit read operation in the itg3200readallchannels function causes uninitialized stack memory to be exposed to userspace. This information leak could allow a local attacker to gain access to...

CVE-2026-63936

A flaw was found in the Linux kernel's MediaTek MT6359 Analog-to-Digital Converter ADC driver. The mt6358readimp function does not properly check the return value of a read operation. If the read fails, an uninitialized variable is used, which can lead to the leakage of sensitive information from...

EUVD-2026-46371

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

EUVD-2026-46378

Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in roaring.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...

EUVD-2026-46366

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind. The attach-time validator sivalidateheader is thorough about the header and layout magic, version, section offsets, totalsize, count and arenaused but does...

CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-10679

The CVE-2026-10679 issue affects Zephyr’s DesignWare SPI driver (drivers/spi/spi_dw.c). The root cause is that the BAUDR clock divider was computed as info->clock_frequency / config->frequency without validating frequency, allowing a userspace thread with SPI access to pass frequency = 0, t...

CVE-2026-63908

A flaw was found in the Linux kernel's atmelmxtts input driver. An incorrect boundary check when handling configuration files with oversized objects can lead to a single-byte overwrite in adjacent memory. This memory corruption vulnerability could allow a local attacker to potentially cause syste...

CVE-2026-63906

A flaw was found in the Linux kernel's USB subsystem. Specifically, within the omap2430 driver, a memory resource is prematurely released while still in use, leading to a use-after-free vulnerability. This could allow a local attacker to cause a system crash denial of service or potentially execu...

CVE-2026-63903

A flaw was found in the Linux kernel's belkinsa USB serial driver. The driver's interrupt handling routine fails to validate the length of incoming status reports. This oversight allows a local attacker, by connecting a specially crafted USB device, to trigger an out-of-bounds read. The primary...

CVE-2026-63894

A flaw was found in the Linux kernel's FunctionFS ffs component. A race condition exists where a Direct Memory Access Buffer DMABUF cancel operation can occur concurrently with a request completion, leading to a use-after-free vulnerability. This allows a privileged local attacker, such as a...

CVE-2026-63897

A flaw was found in the Linux kernel's mctu232 USB serial driver. This vulnerability stems from an inadequate check on the size of data transfers from a USB device. This oversight could allow the system to process outdated or uninitialized kernel memory, potentially leading to information...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

CVE-2026-65056 mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visitpage tool, which only validates the URL protocol without filtering private or reserved IP...

CVE-2026-63892

A flaw was found in the Linux kernel's Thunderbolt property driver. When processing Thunderbolt properties on a non-root path, a crafted entry with a small entry-length value can lead to an out-of-bounds read. This occurs because the kmemdup function reads beyond the intended memory block and a...

CVE-2026-63890

A flaw was found in the Linux kernel's Fibre Channel over Ethernet FCoE module. An unauthenticated attacker on the same Layer 2 L2 network segment could send a specially crafted FCoE Initialization Protocol FIP frame with a malformed descriptor. This could lead to an infinite loop, causing a deni...

CVE-2026-65061

Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in reqrep.h with openpath, ORDWR | OCREAT, 0666, for both the request-reply and the integer-variant segments. The mode is 0666, so under the...