EUVD-2026-55277

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix mmiotrace possible NULL dereferencing of hiter-dev If the mmiopipeopen fails to find a PCI device, the hiter-dev will be assigned to NULL. The mmiotrace read function dereferences the hiter-dev if hiter exists. Chang...

CVE-2026-68155 libceph: Reject monmaps advertising zero monitors

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68146

The CVE-2026-68146 entry documents a Linux kernel ftrace vulnerability where the trace_parser state (idx, cont, buffer) could race when multiple threads share an open trace file descriptor and perform concurrent writes or releases. The fix introduces a global mutex (parser_lock) to serialize all ...

CVE-2026-68146 ftrace: Add global mutex to serialize trace_parser access

In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize traceparser access In ftrace, the traceparser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user inpu...

EUVD-2026-55524

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

EUVD-2026-55504

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...

CVE-2026-64941

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

EUVD-2026-55263

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

EEF-CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

Summary URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private...

CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

CVE-2026-64941

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

CVE-2026-64941

The CVE describes an Open Redirect in Phoenix.LiveView.validate_local_url!/2 where ASCII tab, LF or CR are not rejected. This allows a crafted :to value to bypass path-only validation and be resolved as a scheme-relative URL (e.g., //example.com) when using redirect/2 and related navigation funct...

CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

bestatic (>=0.0.34, <=0.0.36), mkdocs-techdocs-core (1.6.1) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.19.1)

pymdown-extensions PYPI version 10.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - bestatic =0.0.34, =0.6.42, =0.6.43 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

open-webui (>=0.8.0, <=0.8.8) potentially affected by CVE-2026-67422 via pymdown-extensions (10.20.1)

pymdown-extensions PYPI version 10.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.8.0, =0.8.8 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

aurapro-ui (>=3.1.0, <=3.7.4), leopath (>=0.1.3, <=0.2.1) +2 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.21.0)

pymdown-extensions PYPI version 10.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - aurapro-ui =3.1.0, =0.1.3, =0.4.3, =0.8.11, =0.9.6 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

open-webui (>=0.5.17, <=0.6.40), open-webui-steve (0.6.5.45) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.14.2)

pymdown-extensions PYPI version 10.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.5.17, =0.6.40 - open-webui-steve 0.6.5.45 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-67422 Sourc...

open-webui (0.6.41) potentially affected by CVE-2026-67422 via pymdown-extensions (10.17.2)

pymdown-extensions PYPI version 10.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui 0.6.41 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

open-webui (>=0.7.0, <=0.7.2) potentially affected by CVE-2026-67422 via pymdown-extensions (10.20.0)

pymdown-extensions PYPI version 10.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.7.0, =0.7.2 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...