CVE-2026-102365 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

CVE-2026-102365

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

PT-2026-102408

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1 Description The software fails to enforce authorization checks on GET endpoints within the UserAddrController used to retrieve customer address data. Authenticated attackers can access the '/user/addr/page' and...

PT-2026-98581

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ivpu to cpu addr function where the full buffer range is not validated. This can be addressed by adding a size parameter to the function to ensure that the entire...

PT-2026-98017

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the perf subsystem where event::addr filter ranges is used under RCU Read-Copy-Update, a synchronization mechanism that allows multiple readers to access data while it...

PT-2026-104960

In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr filter ranges lifetime Lee Jia Jie reported that since event::addr filter ranges is used under RCU, it should be RCU freed...

PT-2026-97957

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the interpreter ignores the offset at the ALU64 MOV X label for the BPF MOV64 PERCPU REG instruction. This instruction requires Just-In-Time JI...

SUSE CVE-2026-90323

In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown. Split...

CVE-2026-90323

In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown. Split...

EUVD-2026-81984

In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown. Split...

CVE-2026-90323

CVE-2026-90323 affects the ublk (Userspace Block) subsystem of the Linux kernel . When the UBLK_F_AUTO_BUF_REG flag is in use, an invalid sqe->addr can fail after ublk_fill_io_cmd() has already set UBLK_IO_FLAG_ACTIVE . This causes the uring_cmd to be completed while the tag remains active, wh...

CVE-2026-90323: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ublk: validate auto buf reg before taking uringcmd With UBLKFAUTOBUFREG, invalid sqe-addr can fail after ublkfilliocmd has set UBLKIOFLAGACTIVE. The uringcmd is completed while the tag stays active, which can hang teardown. Split...

D-Link DSL-3782 Component Data Compromise

The vulnerability of the /cgi-bin/NewGUI/Set/Diagnostics.asp function of the Diagnostics component of D-Link DSL-3782 router microprogramming software is related to the lack of data cleaning measures at the management level when processing the Addr parameter. Exploiting this vulnerability allows ...

CVE-2026-92395

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

CVE-2026-92395 @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

@anchan828/nest-redis-session-fastify (>=0.0.69, <=0.0.86), @bechara/nestjs-core (>=2.7.0, <=3.1.4) +58 more potentially affected by CVE-2026-92395 via @fastify/proxy-addr (3.0.0)

@fastify/proxy-addr NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/proxy-addr and may be impacted: - @anchan828/nest-redis-session-fastify =0.0.69, =2.7.0, =0.23.0, =0.37.0-dev.2883368c84, =0.23.0, =0.34.0-dev.154,...

CVE-2026-92395 @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

CVE-2026-92395 @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

CVE-2026-92395

@fastify/proxy-addr (a Fastify plugin for determining client IP behind reverse proxies) is vulnerable to IP spoofing in versions 3.0.0 through 5.1.0. The root cause: an IPv4-mapped IPv6 trust subnet with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of /104) is accepted silently but effec...

EUVD-2026-80806

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...