yersinia

Spanning Tree 1: DOS attack sending conf BPDUs Let's send some conf BPDUs claiming be root!!! By sending continously conf BPDU with root pathcost 0, randomly generated bridge id and therefore the same root id, and some default values for other fields, we try to annoy the switches close to us,...

CLEANSTART-2023-ZK23715 STP parser in tcpdump before 4

Security vulnerability affects the tcpdump package. The STP parser in tcpdump before 4...

aegis-finance-mcp (0.1.1), agent-mcp-server (0.0.4.0) +132 more potentially affected by unknown CVE via uv (>=0.1.45, <=0.12.24)

uv PYPI version =0.1.45, =0.11.0, =0.4.7, =0.0.21, =1.2.0rc5, =0.71.2.dev141039313338033, =0.112.0, =0.1.0, =0.1.2, =1.0.3, =0.5.0.dev0, =0.8.0.dev0 - cdm-ecommerce-backend 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:PYSEC-2026-4321...

aegis-finance-mcp (0.1.1), agent-mcp-server (0.0.4.0) +132 more potentially affected by unknown CVE via uv (>=0.1.45, <=0.12.24)

uv PYPI version =0.1.45, =0.11.0, =0.4.7, =0.0.21, =1.2.0rc5, =0.71.2.dev141039313338033, =0.112.0, =0.1.0, =0.1.2, =1.0.3, =0.5.0.dev0, =0.8.0.dev0 - cdm-ecommerce-backend 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-UV-21460703...

aegis-finance-mcp (0.1.1), agent-mcp-server (0.0.4.0) +132 more potentially affected by unknown CVE via uv (>=0.1.45, <=0.12.24)

uv PYPI version =0.1.45, =0.11.0, =0.4.7, =0.0.21, =1.2.0rc5, =0.71.2.dev141039313338033, =0.112.0, =0.1.0, =0.1.2, =1.0.3, =0.5.0.dev0, =0.8.0.dev0 - cdm-ecommerce-backend 0.1.0 and more Source cves: unknown CVE Source advisory: GHSA-HQ85-5CPJ-MR62...

aegis-finance-mcp (0.1.1), agent-mcp-server (0.0.4.0) +132 more potentially affected by unknown CVE via uv (>=0.1.45, <=0.12.24)

uv PYPI version =0.1.45, =0.11.0, =0.4.7, =0.0.21, =1.2.0rc5, =0.71.2.dev141039313338033, =0.112.0, =0.1.0, =0.1.2, =1.0.3, =0.5.0.dev0, =0.8.0.dev0 - cdm-ecommerce-backend 0.1.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0173...

ai-stp-cli (>=0.0.23, <=0.0.33), pygpt-net (>=2.8.27, <=2.9.1) +1 more potentially affected by CVE-2026-104843 via uv (>=0.12.10, <=0.12.15)

uv PYPI version =0.12.10, =0.0.23, =2.8.27, =2.9.1 - uvenv 3.11.1 Source cves: CVE-2026-104843 Source advisory: OSV:PYSEC-2026-4305...

yersinia

Árbol de expansión 1: Ataque DoS enviando BPDUs de configuración ¡Enviemos algunos BPDUs de configuración afirmando ser la raíz!!! Al enviar continuamente BPDUs de configuración con root pathcost 0, ID de puente generado aleatoriamente y por lo tanto el mismo ID raíz, y algunos valores...

ai-stp-cli (>=0.0.23, <=0.0.33), pygpt-net (>=2.8.27, <=2.9.1) +1 more potentially affected by CVE-2026-104843 via uv (>=0.12.10, <=0.12.15)

uv PYPI version =0.12.10, =0.0.23, =2.8.27, =2.9.1 - uvenv 3.11.1 Source cves: CVE-2026-104843 Source advisory: OSV:GHSA-2CV4-CQWR-GWF7...

ai-stp-cli (>=0.0.23, <=0.0.33), pygpt-net (>=2.8.27, <=2.9.1) +1 more potentially affected by CVE-2026-104843 via uv (>=0.12.10, <=0.12.15)

uv PYPI version =0.12.10, =0.0.23, =2.8.27, =2.9.1 - uvenv 3.11.1 Source cves: CVE-2026-104843 Source advisory: GHSA-2CV4-CQWR-GWF7...

ai-stp-cli (>=0.0.23, <=0.0.33), pygpt-net (>=2.8.27, <=2.9.1) +1 more potentially affected by CVE-2026-104843 via uv (>=0.12.10, <=0.12.15)

uv PYPI version =0.12.10, =0.0.23, =2.8.27, =2.9.1 - uvenv 3.11.1 Source cves: CVE-2026-104843 Source advisory: MEND:CVE-2026-104843...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bridge: stp – Fixed a potential use-after-free when deleting a bridge. The three STP timers should not be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put administratively...

SUSE-SU-2026:4190-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267369. - CVE-2026-52955: libceph: Fix potential out-of-bounds access in crushdecode...

CVE-2026-72389

A flaw was found in the Linux kernel's bridge Spanning Tree Protocol STP module. A missing check in the brtopologychangedetection function allows a topology change timer to be armed while a bridge is administratively down. This can be exploited by an attacker to trigger a use-after-free...

SUSE CVE-2026-72389

In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put...

CVE-2026-72389

In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put...

CVE-2026-72389

In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put...

UBUNTU-CVE-2026-72389

In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put...

CVE-2026-72389 bridge: stp: Fix a potential use-after-free when deleting a bridge

In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put...

CVE-2026-72389

The vulnerability CVE-2026-72389 affects the Linux kernel’s bridge STP implementation. The root cause is a missing IFF_UP check in br_topology_change_detection(), which could allow arming the topology change timer while a bridge is administratively down, potentially causing a use-after-free when ...