CVE-2025-26206

CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0 -critical.svg -blue.svg A critical Cross-Site Request Forgery CSRF vulnerability in Selldone Storefront v1.0 allows remote attackers to escalate privileges by tricking authenticated users into executing state-changing...

SUSE CVE-2026-116581

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

CVE-2026-116748

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enablin...

UBUNTU-CVE-2026-116748

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enablin...

CVE-2026-116581 Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

CVE-2026-116581 Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

CVE-2026-116581 Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

PT-2026-125387

Name of the Vulnerable Software and Affected Versions Seroval versions prior to 1.6.8 Description Seroval allows for the stringification of JavaScript values, including complex structures. The fromJSON and fromCrossJSON functions fail to validate the done index of a sequence node. A specially...

PT-2026-122012

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req timeout while a request is active. msdc request done uses cancel delayed work, which does not wait for a timeout callback that has already started. The...

PT-2026-116831

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the catc rx done function where it fails to properly bound the RX packet length when processing a multi-packet URB USB Request Block. The function compares the packet...

PT-2026-128396

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catc rx done catc rx done walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pkt len urb-actual length, ignores the header offset and compares...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the “block” layer, do not call “rqqosops-donebio” if the bio data structure is not being tracked. The “rqqos” framework is only applied on request-based drivers. Therefore: 1 The “rqqosdonebio” function is not necessary for...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix race on per-CQ variable napi workdone After calling napicompletedone, the NAPIFSTATESCHED bit may be cleared, allowing another CPU to start a napi thread and access the per-CQ variable, cq-workdone. If this other...

CVE-2026-91191

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

PT-2026-102913

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

PT-2026-94632

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the firmware loader where fw load sysfs fallback calls device add before adding fw priv to pending fw head. This allows a userspace helper to complete the request via...

PT-2026-93503

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak occurs in the qla2xxx driver within the SCSI subsystem. The function qla28xx validate flash image unconditionally returns QLA SUCCESS, signaling to the FC BSG transport...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Fixed the memory ordering between normal and ordered work functions. Ordered work functions are not guaranteed to be handled by the same thread that executes the normal work functions. The only way to synchronize...

SUSE CVE-2026-74270

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-74270

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...