curl: CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints

Hi all, I found a way for a server to defeat --remote-header-name's -J no-clobber guarantee: with curl -O -J -i, sending a 103 Early Hints before the final response or an ETag ahead of Content-Disposition under --etag-save lets a server overwrite an existing file it names via Content-Disposition,...

EUVD-2026-76740

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

EUVD-2026-76746

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

Linux Distros Unpatched Vulnerability : CVE-2026-90558

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit...

Linux Distros Unpatched Vulnerability : CVE-2026-89562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenev...

CVE-2026-90453

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90453

CVE-2026-90453 affects a file-upload handler that redirects an authenticated client's browser to a URL taken directly from the request's Referer header , without validating it against the application's own origin. An authenticated attacker can craft a request that causes another user's browser to...

CVE-2026-90453 Open Redirect in Malcolm

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-90453 Open Redirect in Malcolm

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-90453 Open Redirect in Malcolm

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-90447 Authentication Bypass by Spoofing in Malcolm

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90447 Authentication Bypass by Spoofing in Malcolm

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90447 Authentication Bypass by Spoofing in Malcolm

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90447

This ICS-CERT advisory (CSAF reference: ICSA-26-254-01) describes a privilege escalation vulnerability in a downstream service where a routing rule selects between two authentication mechanisms based on a client-supplied request header . An authenticated user possessing a shared service credentia...

AZL-100184 CVE-2026-89608 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

DEBIAN-CVE-2026-89608

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

DEBIAN-CVE-2026-89574

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

AZL-100133 CVE-2026-89574 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

AZL-100340 CVE-2026-89562 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...