CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

CVE-2026-74580

This vulnerability affects the Linux kernel's vhost subsystem . The vring metadata cache (vq->meta_iotlb[]) is not reset when VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM reconfigures a virtual queue, causing iotlb_access_ok() to return early on a stale cache hit and skip re-validation. With a ...

CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

CVE-2026-69502

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-22681

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

EUVD-2026-63999

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-22681

OpenViking (by Volcengine) before 0.3.4 is vulnerable to Server-Side Request Forgery (SSRF) via the /api/v1/resources endpoint. An authenticated low-privilege attacker can POST a crafted URL, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, ...

CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-75933

Jet Admin is vulnerable to a stored cross-site scripting (XSS) flaw in the sign-in page's scripts and styles option. An authenticated attacker can inject arbitrary JavaScript that executes in the context of any visiting user's domain, enabling session hijacking, data exfiltration, or further comp...

CVE-2026-69502

CVE-2026-69502 is a server-side request forgery (SSRF) vulnerability in Azure SQL Database that allows an unauthorized, network-based attacker to elevate privileges . The CNA-assigned CVSS 3.1 score is 10.0 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating no privileges ...

EUVD-2026-63994

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-77814

ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparentpath, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed ...

CVE-2026-63343

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The...

CVE-2026-55622

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-55621

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-48749

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...

CVE-2026-48752

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue...

ubuntu-privesc-lab

ubuntu-privesc-lab Flusso di lavoro completo di penetration testing: brute force delle credenziali, accesso SSH ed escalation dei privilegi CVE-2021-4034 PANORAMICA Questo progetto dimostra un flusso di lavoro completo di penetration testing contro una macchina virtuale Ubuntu vulnerabile. La...

CVE-2026-77814

Infinite Image Browsing , a Stable Diffusion WebUI extension, contains a path traversal flaw in is_path_trusted (scripts/iib/api.py). The function uses path.startswith(parent_path) without appending a path separator, so a directory whose name merely begins with an allowed path (e.g., /data/images...

EUVD-2026-63992

ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparentpath, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed ...