CVE-2026-64320

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Page Offset lpo. The 64-bit offset is then added to a small kzalloc'd...

CVE-2026-64320

CVE-2026-64320 concerns the Linux kernel nvmet Discovery Get Log Page path. The underlying issue is that nvmet_execute_disc_get_log_page() only validates the dword alignment of the host-supplied Log Page Offset (lpo) but then adds a 64-bit offset to a small kzalloc’d buffer and copies data_len by...

CVE-2026-64320 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Page Offset lpo. The 64-bit offset is then added to a small kzalloc'd...

EUVD-2026-49032

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Page Offset lpo. The 64-bit offset is then added to a small kzalloc'd...

CVE-2026-64319: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmetauthreply accesses the variable-length rval array using attacker-controlled hl hash length and dhvlen DH value length fields without verifying they fi...

Linux Distros Unpatched Vulnerability : CVE-2026-64320

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Pa...

CVE-2026-64320: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Page Offset lpo. The 64-bit offset is then added to a small kzalloc'd...

CVE-2026-64320: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Page Offset lpo. The 64-bit offset is then added to a small kzalloc'd...

MAL-2026-11069 Malicious code in clerk-next-fix-auth-protection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fd8aaf2fc6ca964eed6950b6868486125905bacabe6b8bb1cbd581bb6a59f4c [email protected] is a typosquat of Clerk/Next.js auth tooling that ships no functional code declared main index.js is absent from...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the SASL PLAIN authentication process. An attacker can gain unauthorized access to arbitrary directory user accounts by supplying an authorization identity authzid that resolves to a...

GHSA-P279-2CQP-84JG OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIEDAUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...

GO-2026-5346 Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

Caddy: FastCGI header normalization bypass in forwardauth copyheaders in github.com/caddyserver/caddy...

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Summary The Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact wit...

GHSA-G9HV-X236-4QP3 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Summary A malicious SSH server can crash a russh client session with a single malformed key-exchange reply, causing a pre-authentication Denial-of-Service before the server host key is verified. The embedding process itself stays up, but the connection is killed deterministically. Details Every...

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

A pre-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An unauthenticated client sends a single SSHMSGKEXECDHINIT whose QC is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero pee...

CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

Open Redirect

Overview @backstage/plugin-auth-backend is an A Backstage backend plugin that handles authentication Affected versions of this package are vulnerable to Open Redirect via the allowlist matching process. An attacker can intercept authorization codes by registering an OAuth client with a crafted...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.18-next.0) +12 more potentially affected by CVE-2026-73563 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.2-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.17-next.0) +12 more potentially affected by CVE-2026-73563 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.1-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.18-next.0) +12 more potentially affected by unknown CVE via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.2-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...