NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

The NSEC3 closest-encloser proof validation in hickory-proto's DnssecDnsHandle walks from the QNAME up to the SOA owner name, building a list of candidate encloser names. The iterator used assumes the QNAME is a descendant of the SOA owner, terminating only when the current candidate equals the S...

RUSTSEC-2026-0118 NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

The NSEC3 closest-encloser proof validation in hickory-proto's DnssecDnsHandle walks from the QNAME up to the SOA owner name, building a list of candidate encloser names. The iterator used assumes the QNAME is a descendant of the SOA owner, terminating only when the current candidate equals the S...

CLSA-2026-1777614651 kernel: Fix of 52 CVEs

crypto: algifaead - Fix minimum RX size check for decryption - crypto: afalg - Fix page reassignment overflow in afalgpulltsgl - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authenc - use...

WordPress Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins plugin <= 6.1.13 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Authorize.Net Payment Gateway For WooCommerce versions = 6.1.13...

Exploit for External Control of File Name or Path in Microsoft

CVE-2025-24054 PoC A simple Proof of Concept for CVE-2025-2...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from improper lifecycle management of netdevice in fecm, potentially leading to suspended sysfs symbol...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from improper lifecycle management of netdevice in fsubset. This vulnerability may lead to suspended...

PT-2026-36360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb gadget f ecm component where the net device is allocated during function instance creation and registered during the bind phase. When the function unbinds, the...

PT-2026-36430

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the net/mlx5 component where the function mlx5 lag dev add mdev may return success even if a gracefully handled error occurs. This allows the initialization process to...

PT-2026-36359

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb gadget f eem component where the net device is allocated during function instance creation and registered during the bind phase. When the function unbinds, the...

PT-2026-36409

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring network component where a slab-out-of-bounds read can occur in the io bundle nbufs function. This happens when userspace provides a sqe-len value exceedin...

PT-2026-36371

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the mtk ppe component of the ethernet network subsystem when gmac0 is disabled. The system crashes because the code attempts to access netdev ops...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the bnxthwrmfuncbackingstoreqcapsv2 function in the bnxten driver that does not set ctxm-type correctly,...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from improper lifecycle management of netdevice in frndis, potentially leading to suspended sysfs...

PT-2026-36357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw in the USB gadget RNDIS component allows a network device to persist after the bind and unbind process, creating a zombie device. This occurs because the net device is allocated...

PT-2026-36358

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb gadget f subset component where the net device is allocated during function instance creation and registered during the bind phase with the gadget device as it...

JLSEC-2026-372

A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handleopt of the file /src/netbuiltin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.60 packages and security update

Red Hat OpenShift Container Platform release 4.16.60 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...