EUVD-2026-89716

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102577

A flaw in Moodle 's URL downloader allows an authenticated remote user to bypass host-blocking restrictions. The root cause is the incorrect handling of IPv4-mapped IPv6 addresses , which enables an attacker to provide a crafted URL that forces the server to make requests to restricted destinatio...

CVE-2026-102577 Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102577 Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102577

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

PT-2026-103085

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted...

ROS-20260930-73-0053

The vulnerability in the kernel-lt is related to incorrect blocking of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-102577: Server-Side Request Forgery (SSRF)

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

GHSA-Q2HR-2G5M-VWHR brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

Summary Expanding a,b-shaped input takes time quadratic in the number of literal characters, blocking the event loop. Bash preserves a quirk where a brace group followed by a comma set still expands a,b. The parser implements this by rewriting the string and restarting the scan. Each pass absorbs...

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

Summary Expanding a,b-shaped input takes time quadratic in the number of literal characters, blocking the event loop. Bash preserves a quirk where a brace group followed by a comma set still expands a,b. The parser implements this by rewriting the string and restarting the scan. Each pass absorbs...

CVE-2026-97501

A flaw was found in the Linux kernel's MediaTek pin controller pinctrl driver, which can lead to a Denial of Service DoS. When configuring general-purpose input/output GPIO pin directions, the driver attempts to acquire a blocking lock while operating in an atomic context. A local attacker could...

Lessons from Microsoft Patch KB5002907: Two Layers of Patch Control in Qualys TruRisk Eliminate

How reliability scoring keeps risky patches out of zero-touch jobs, and how one blocking rule stops a paused update across your environment. Executive Summary Microsoft has paused the rollout of KB5002907, an optional Microsoft 365 Apps update that left some Office 2016 and Office 2019...

CLEANSTART-2026-GT01967 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

CVE-2026-18401 affects multiple packages. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. See references for individual vulnerability details...

ROS-20260929-73-0154

The vulnerability in the kernel-lt is related to incorrect blocking of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260929-73-0004

The vulnerability of the nvme-multipath component of the Linux operating system’s kernel is related to errors during thread blocking. Exploiting this vulnerability allows an attacker to cause a service failure...

CVE-2026-98045

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. Certain stack retrieval helper functions can perform blocking filesystem operations, but were not properly marked as sleepable. A local user with permission to load BPF programs could exploit this flaw by invoking these...

ROS-20260928-73-0049

The vulnerability of the fs/fuse component in Linux operating systems is related to errors during thread blocking. Exploiting this vulnerability can allow an attacker to cause a service failure...

DEBIAN-CVE-2026-98045

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

CVE-2026-98004

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...

DEBIAN-CVE-2026-98004

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...