SUSE CVE-2026-64028

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

CVE-2026-64028

In the Linux kernel tracing subsystem, CVE-2026-64028 affects hist_field_name() in the fully-qualified VAR_REF/EXPR path: when snprintf() truncation returns NULL, callers mistakenly dereference NULL in strcat(expr, hist_field_name(field, 0)) and in a sort-key strcmp, potentially leading to NULL d...

PT-2026-61345

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from hist field name on truncation hist field name returns "" everywhere except the fully-qualified VAR REF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

CVE-2026-62948

OpenWrt odhcpd/LuCI vulnerability CVE-2026-62948: Before 25.12.5, the DHCPv6 client FQDN option 39 hostname is written into /tmp/odhcpd.leases without escaping, allowing newline injection of forged lease lines. LuCI displays these lines in the Active DHCPv6 Leases page via rpcd-mod-luci getDHCPLe...

MAL-2026-5612 Malicious code in gpt-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b9bdc5e04979d5b4f73407bcedaecc9df24dbb03e0bfbc0edefe333023dc50c On npm install, postinstall.js runs unconditionally and collects a wide range of installer-side reconnaissance data: hostname and FQDN, contents of...

CVE-2026-42965 Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN Fully Qualified Domain Name EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud...

CVE-2026-42965 Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN Fully Qualified Domain Name EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 7.x, 8.x, 9.2.27 and earlier, 9.3.26 and earlier, and 9.4.16 and earlier, the server running on any operating system and Jetty version combination will display a 404 error in the output, indicating that no Context matching the requested path was found. The default server...

CVE-2026-7584

The LabOne Q serialization framework uses a class-loading mechanism importcls to dynamically import and instantiate Python classes during deserialization. Prior to the fix, this mechanism accepted arbitrary fully-qualified class names from the serialized data without any validation of the target...

php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

A vulnerability was found in PHP. If a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:3682-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3682-1 advisory. go1.24.9 released 2025-10-13 includes fixes to the crypto/x509 package. bsc1236217 crypto/x509:...

EUVD-2005-3173

Malware in sbrugna...

EUVD-2002-1940

Malware in sbrugna...

Connection to Veeam Software Appliance Fails With: "Authentication failed: invalid credentials"

Challenge When attempting to use local account credentials to connect to a Veeam Software Appliance that is joined to a domain, the Console fails to connect with the errror: Authentication failed: invalid credentials Cause This error occurs due to an account collision caused by the...

NetScaler: Securing HA Management IPs and FQDN with SAN Certificates

Securing Management IP and FQDN for High Availability Citrix ADCs with SAN Certificates Ensuring the secure management of your Citrix Application Delivery Controllers ADCs in a High Availability HA setup is crucial for maintaining the integrity and confidentiality of your infrastructure. This...

libreswan: Invalid IKEv1 Quick Mode ID causes restart

A NULL pointer dereference flaw was found in Libreswan when processing IKEv1 Quick Mode requests. When an IKEv1 Quick Mode connection configured with IDIPV4ADDR or IDIPV6ADDR receives an IDcr payload with IDFQDN, it triggers a NULL pointer dereference error. This flaw allows a malicious client or...

AZL-28065 CVE-2023-38711 affecting package libreswan for versions less than 4.7-5

An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with IDIPV4ADDR or IDIPV6ADDR receives an IDcr payload with IDFQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6...

PT-2023-5265 · Libreswan +5 · Libreswan +5

Name of the Vulnerable Software and Affected Versions: Libreswan versions prior to 4.12 Description: An issue was discovered in Libreswan when an IKEv1 Quick Mode connection configured with ID IPV4 ADDR or ID IPV6 ADDR receives an IDcr payload with ID FQDN, causing a NULL pointer dereference. Thi...

PT-2023-24777 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.42 Description: The issue concerns a flat-file content management system where the denylist, introduced to prevent the execution of dangerous functions via malicious template injection, was insufficient. This allowe...

Fully qualified domain names are incorrectly resolved

Lines of code Vulnerability details Impact A relative domain name like foo.eth becomes fully qualified if it ends with a dot, e.g. foo.eth., although this might seem unfamiliar to some, it's the standard and part of the DNS specification, see Fully qualified domain name, Trailing Dots in Domain...