ROS-20260930-73-0143

The vulnerability in the drivers/nvme/host/fc.c module of the Linux operating system is related to the improper shutdown or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-51869

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host...

CVE-2026-102577: Server-Side Request Forgery (SSRF)

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

PT-2026-103281

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

PT-2026-103311

🚨 CVE-2026-100264 In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host 🎖@cveNotify...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: runc (UTSA-2026-126154)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-126154 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1746188134)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746188134 advisory. - A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host...

Rocky Linux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the...

AlmaLinux 9.2 [TuxCare] Security Update: runc (ALMALINUX9.2:CLSA-2026:1784034091)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784034091 advisory. - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1,...

CentOS Linux 7 [TuxCare] Security Update: wget (CENTOS7:CLSA-2024:1723796201)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1723796201 advisory. - url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which...

AlmaLinux 9.2 [TuxCare] Security Update: systemd / systemd-boot-unsigned / systemd-container / systemd-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787064068)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787064068 advisory. - In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783353048)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783353048 advisory. - A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt is a multiple of 2GiB. This...

NPM: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

NPM: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.7...

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

Impact fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference //host there is no scheme, so the host canonicalization that repairs this on a...

SUSE CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-103043

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

Uncaught Exception

Overview org.webjars.npm:adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Uncaught Exception via inflateAsync in methods/inflater.js when processing a ZIP entry containing malformed DEFLATE data. The...

CVE-2026-103043 anchorme through 3.0.8 Regular Expression Denial of Service

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-103043 anchorme through 3.0.8 Regular Expression Denial of Service

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-103043

The anchorme library (versions through 3.0.8 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue resides in the IPv6 host extraction regex , where catastrophic backtracking can be triggered by specially crafted input strings with repeated patterns. This causes exponentia...