PT-2026-65720

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through...

Linux Distros Unpatched Vulnerability : CVE-2026-33930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflo...

Linux Distros Unpatched Vulnerability : CVE-2026-58186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0...

Linux Distros Unpatched Vulnerability : CVE-2026-58163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0...

Linux Distros Unpatched Vulnerability : CVE-2026-54605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw...

SUSE SLES16 Security Update : runc (SUSE-SU-2026:22942-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22942-1 advisory. Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations...

Linux Distros Unpatched Vulnerability : CVE-2026-24033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-58152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through...

PT-2026-65882

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.8 through 19.0.4 GitLab EE versions 19.1 through 19.1.2 GitLab EE versions 19.2 through 19.2.0 Description Improper handling of upstream requests in virtual registries could allow sensitive information to be disclosed to ...

Linux Distros Unpatched Vulnerability : CVE-2026-58153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apac...

Linux Distros Unpatched Vulnerability : CVE-2026-64647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a...

Linux Distros Unpatched Vulnerability : CVE-2026-64649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action...

Linux Distros Unpatched Vulnerability : CVE-2026-58216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded...

The vulnerability of the scsi_host_busy() function in the drivers/scsi/hosts.c module of the Linux operating system’s SCSI device driver allows a attacker to cause a service failure.

The vulnerability of the scsihostbusy function in the drivers/scsi/hosts.c module of the Linux SCSI device driver framework is related to improper initialization of resources. Exploiting this vulnerability could allow an attacker to cause service failures...

Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenS...

CVE-2026-54691

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

Server-side Request Forgery (SSRF)

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the getbody function when processing URLs provided via the --url argument, as there is no validation of host or IP addresses and redirects are...

GHSA-RFR2-MQ9M-X2QX datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Summary datamodel-code-generator's built-in HTTP fetcher http.getbody issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and followredirects=True. Loopback addresses, RFC1918 ranges, link-local 169.254.169.2...

CVE-2026-54691

CVE-2026-54691 affects datamodel-code-generator prior to 0.61.0; the http.get_body function in src/datamodel_code_generator/http.py accepts --url targets and redirect chains without host/IP validation, enabling server-side request forgery to loopback, private, link-local, metadata, and other netw...

CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...