PT-2026-64478

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB2 client where the smb2 calc size function clears data length during overlap handling. This behavior can cause an invalid response to be incorrectly identified ...

PT-2026-64605

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt may return a replayable error and free its response buffer. If the SMB2 notify init function fails before the...

PT-2026-64671

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE MSG can carry a Gap ACK blocks record in its data area. tipc get gap ack blks only verifies that the record's len field is self-consistent with i...

PT-2026-64609

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Ownership and group modifications were ignored when mounting with SMB3 POSIX Extensions, unless CIFS MOUNT CIFS ACL or CIFS MOUNT MODE FROM SID were explicitly set. The issue occurs with...

Linux Distros Unpatched Vulnerability : CVE-2026-64379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mod...

Linux Distros Unpatched Vulnerability : CVE-2026-64388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions...

Linux Distros Unpatched Vulnerability : CVE-2026-64437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred filelock on SMB2CLOSE then SMB2CANCEL Commit...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

GO-2026-5525 GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp

GoBGP has a panic in AdjRib.Update via malformed BGP Update message Nil Pointer Dereference in github.com/osrg/gobgp...

GHSA-73X5-H92W-XC2J Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/id/messages/messageid/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the chat completion process. An attacker can overwrite messages in channels they do not belong to, including private and direct message channels, by supplying a crafted chatid an...

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through...

GHSA-X2FF-V5V8-M75M Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through...

CVE-2026-66027

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

EUVD-2026-48641

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

CVE-2026-66027 Suna < 0.9.102 Broken Access Control via Message Queue API

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

CVE-2026-66027

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

CVE-2026-66027

The CVE-2026-66027 entry documents a broken access control in Suna

CVE-2026-66027 Suna < 0.9.102 Broken Access Control via Message Queue API

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID

A flaw was found in RabbitMQ. An authenticated MQTT Message Queuing Telemetry Transport user can bypass topic-level authorization by injecting regular expression operators. This occurs because the client ID, provided by the user in the MQTT CONNECT packet, is inserted into authorization regex...