undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

BIT-APACHE-2026-63292 Apache HTTP Server: mod_vhost_alias stack overflow

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

AZL-106245 CVE-2026-98210 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: cancel data work and watchdog on remove mxcmciremove frees the host through the devm tail, but neither it nor mmcremovehost drains the driver's own asynchronous state. host-watchdog, a 10 s timer armed on the DMA pat...

UBUNTU-CVE-2026-98242

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

UBUNTU-CVE-2026-98210

In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: cancel data work and watchdog on remove mxcmciremove frees the host through the devm tail, but neither it nor mmcremovehost drains the driver's own asynchronous state. host-watchdog, a 10 s timer armed on the DMA pat...

CVE-2026-98210

In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: cancel data work and watchdog on remove mxcmciremove frees the host through the devm tail, but neither it nor mmcremovehost drains the driver's own asynchronous state. host-watchdog, a 10 s timer armed on the DMA pat...

CVE-2026-98242 dma-buf: Fix silent overflow for phys vec to sgt

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

CVE-2026-98210 mmc: mxcmmc: cancel data work and watchdog on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: cancel data work and watchdog on remove mxcmciremove frees the host through the devm tail, but neither it nor mmcremovehost drains the driver's own asynchronous state. host-watchdog, a 10 s timer armed on the DMA pat...

CVE-2026-25274 Use After Free in Windows WLAN Host

Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...

CVE-2026-25274

The Windows WLAN Host is susceptible to a Memory Corruption vulnerability (CWE-416) due to a Use After Free condition. This issue arises when the system processes concurrent DMA buffer allocation and deallocation commands without proper synchronization. Exploitation requires high privileges and i...

CVE-2026-25274 Use After Free in Windows WLAN Host

Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...

psbug-host

psbug-host Open the host: https://sliptripfalldown.github...

Brocade Fabric OS authentication and access control bypass via HTTP host header spoofing

: An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual...

PT-2026-107177

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea fails to revalidate destinations when raw Git operations follow HTTP redirects during push mirrors, wiki remote checks, and fetches of migrated pull request heads. A repository...

sudo security update

1.9.17-7 - CVE-2026-96512 sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization rhel-10.2.z 1.9.17-6 - Fix CVE-2026-82474: execveat2 intercept/logsubcmds bypass 1.9.17-5.p2 - Resolves: RHEL-212546 - Use canonicalized path if user path contains '..'...

Linux Distros Unpatched Vulnerability : CVE-2026-98323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first...

CVE-2026-104636: Server-Side Request Forgery (SSRF)

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...

Linux Distros Unpatched Vulnerability : CVE-2026-98367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and...