39697 matches found
CVE-2026-97876
A flaw in GRUB2 allows a local attacker with control over the boot configuration to bypass Secure Boot lockdown restrictions. The root cause is the insufficient validation of the MMIO base address passed to the serial command; GRUB fails to verify that the address corresponds to a legitimate UART...
CVE-2026-97876 Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...
CVE-2026-97876 Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...
CVE-2026-97876
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...
jsoncons:fuzz_cbor_encoder: Bad parameters to --sanitizer-annotate-contiguous-container in jsoncons::cbor::basic_cbor_parser<jsoncons::stream_source<unsigned char, std::__
Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=5862127433482240 Project: jsoncons Fuzzing Engine: afl Fuzz Target: fuzzcborencoder Job Type: aflasanjsoncons Platform Id: linux Crash Type: Bad parameters to...
CLEANSTART-2026-MP17411 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Security vulnerability affects the consul package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
CVE-2026-97876: Untrusted Pointer Dereference
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...
nodejs:24 security, bug fix, and enhancement update
nodejs 1:24.21.0-1 - Update to version 24.21.0 Fix: CVE-2026-85152 CVE-2026-84961 CVE-2026-19534 Resolves: RHEL-255252 RHEL-255291 RHEL-255313 RHEL-249188 1:24.18.0-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 5.9.0 Fix: CVE-2026-69192 & CVE-2026-54272...
Linux Distros Unpatched Vulnerability : CVE-2026-97876
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while...
CLSA-2026-1790890883 TuxCare security update for ip-address (3 CVEs)
TuxCare rebuilt ip-address to address 3 CVEs. Fixed in 7.1.0-tuxcare.4...
CVE-2026-95279
An ui misrepresentation flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514012689...
PYSEC-2026-4064 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
SummaryLightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...
fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization
A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...
CLSA-2026-1790864845 TuxCare security update for ip-address (1 CVE)
TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.5...
CLSA-2026-1790862953 TuxCare security update for ip-address (1 CVE)
TuxCare rebuilt ip-address to address 1 CVE. Fixed in 10.7.0-tuxcare.2...
CLSA-2026-1790854765 TuxCare security update for ip-address (1 CVE)
TuxCare rebuilt ip-address to address 1 CVE. Fixed in 10.7.0-tuxcare.1...
CVE-2026-103280
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...
CVE-2026-103280
The Ghost content management system, versions 0.8.0 before 6.23.0 , is susceptible to an information disclosure vulnerability. The setup endpoint fails to perform proper authentication and responds to unauthenticated requests by revealing the site owner's email address . This allows any remote vi...
CVE-2026-103280 Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...