UBUNTU-CVE-2026-68120

In the Linux kernel, the following vulnerability has been resolved: rtase: Workaround for TX hang caused by hardware packet parsing The hardware performs packet parsing before packet transmission. Parsing incomplete IPv4, IPv6, TCP, or UDP headers may trigger a TX hang because the hardware parser...

CVE-2026-68379 tcp: fix TIME_WAIT socket reference leak on PSP policy failure

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIMEWAIT socket reference leak on PSP policy failure Release the TIMEWAIT socket reference and jump to discardit upon PSP policy failure in both IPv4 and IPv6 receive paths. This prevents a memory leak of tcptwbucket...

CVE-2026-68120

CVE-2026-68120 affects the Linux kernel rtase driver. The vulnerability stems from hardware packet parsing that may trigger a TX hang when processing incomplete IPv4/IPv6/TCP/UDP headers or certain UDP packets with insufficient transport data, causing a Denial of Service. The kernel release notes...

SUSE CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:3520-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3520-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...

CVE-2026-64572

A flaw was found in the Linux kernel's IPv4 forwarding information base FIB component. A local attacker with administrative network capabilities CAPNETADMIN could exploit a timing issue during route insertion and lookup operations. This could lead to a "use-after-free" vulnerability, where the...

SUSE CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

Malicious code in ach-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c8ce91cbe1aaa587613795b1b82cc84384b499a29af4a18c0a820b77ea1d834 The npm package [email protected] ships a preinstall lifecycle script scripts/preinstall.js that runs automatically on npm install. The script collec...

Malicious code in datefmt-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787 datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall...

EUVD-2026-53266

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

SUSE CVE-2026-69192

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library...

Linux Distros Unpatched Vulnerability : CVE-2026-64572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib ent...

EUVD-2026-39025

Ghost: Private IP filtering bypass to make server-side requests to internal services...

CVE-2026-70485

CVE-2026-70485 – Open WebUI : Affected versions 0.9.0 through 0.11.0 of the Open WebUI self-hosted AI platform check whether a user-provided URL is globally routable by applying ipaddress.is_global to the literal IPv6 address, without considering embedded IPv4 in transition encodings. In NAT64 de...

CVE-2026-69257

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise's HTTP security module httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 and ::ffff:169.254.169.254 before checking them against the deny list...

GHSA-C6XH-WV4J-PPV5 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Summary Flowise's HTTP security module httpSecurity.ts fails to normalize IPv4-mapped IPv6 addresses e.g., ::ffff:127.0.0.1, ::ffff:169.254.169.254 before checking them against the deny list. Due to an ipaddr.js kind mismatch ipv6 vs ipv4, all IPv4 CIDR deny rules are silently skipped for...

AZL-94577 CVE-2026-70367 affecting package stunnel 5.74-1

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

EUVD-2026-52687

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...