CVE-2026-95279

An ui misrepresentation flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514012689...

lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

SummaryLightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

PYSEC-2026-4064 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...

CLSA-2026-1790864845 TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.5...

CLSA-2026-1790862953 TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 10.7.0-tuxcare.2...

CLSA-2026-1790854765 TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 10.7.0-tuxcare.1...

CVE-2026-103280

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...

CVE-2026-103280 Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...

CVE-2026-103280

The Ghost content management system, versions 0.8.0 before 6.23.0 , is susceptible to an information disclosure vulnerability. The setup endpoint fails to perform proper authentication and responds to unauthenticated requests by revealing the site owner's email address . This allows any remote vi...

BIT-PHP-MIN-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

BIT-PHP-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

BIT-LIBPHP-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CLEANSTART-2023-KF11060 invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj

Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the hfassembly function of libfaad/sbrhfadj...

CLEANSTART-2023-YY56914 invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec

Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbrdec...

CLEANSTART-2023-LS66031 invalid memory address dereference was discovered in the lt_prediction function of libfaad/lt_predict

Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the ltprediction function of libfaad/ltpredict...

CLEANSTART-2023-VH05257 invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec

Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the sbrprocesschannel function of libfaad/sbrdec...

CLEANSTART-2023-XG43309 invalid memory address dereference was discovered in the huffcode function (libfaac/huff2

Security vulnerability affects the faac package. An invalid memory address dereference was discovered in the huffcode function libfaac/huff2...

CLEANSTART-2026-MQ17226 certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain

Security vulnerability affects the cri-tools package. A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain...

Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...