Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

🚀 CVE-2026-31431 – Advanced Linux Kernel Exploit "From...

Linux Distros Unpatched Vulnerability : CVE-2026-64459

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcpaodestroysock Commit 51e547e8c89c tcp: Free...

PT-2026-64739

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access occurs in the tcp ao established key function when it is called from tcp v46 timewait ack using a twsk TCP time-wait socket. This happens because the lockdep sock...

CVE-2026-64406: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in btacceptdequeue btacceptget takes a temporary reference before dropping the accept queue lock. btacceptdequeue currently drops that reference before btacceptunlink, leaving only the queue reference...

openSUSE 16 Security Update : perl (openSUSE-SU-2026:21411-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21411-1 advisory. - CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date bsc1266361. - CVE-2026-8376:...

Linux Distros Unpatched Vulnerability : CVE-2026-64523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between...

PT-2026-64680

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where the RCU Read-Copy-Update grace period was incorrectly removed from the tcp ao destroy sock function. This occurs specifically during the t...

PT-2026-64754

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/handshake component where the handshake nl accept doit function requires the file pointer backing req-hr sk-sk socket to remain valid between the execution of...

PT-2026-64625

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the Bluetooth ISO implementation. The function iso conn big sync drops the socket lock to call hci get route and subsequently re-acquires it. However...

GHSA-G5VV-Q72C-7J78 @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

Summary @anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned up, even...

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the sessio...

GHSA-74H3-CXQ7-VC5Q Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the sessio...

GHSA-855V-HQ7W-JMJW Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Summary The Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact wit...

EUVD-2026-42623

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers ydoc:awareness:update, ydoc:document:leave...

Missing Authentication for Critical Function

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authentication for Critical Function via unauthenticated access to the ydoc:awareness:update and ydoc:document:leave event handlers. An attacker can disrupt collaborative editing sessions, impersonate...

CVE-2026-45811

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...

CVE-2026-45811: Buffer Copy without Checking Size of Input

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...

Security update for PackageKit (moderate)

openSUSE security update: security update for packagekit ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21425-1 Rating: moderate References: bsc1263252 bsc1267250 Cross-References: CVE-2026-10294 CVSS scores: CVE-2026-10294 SUSE : 4.3...