EUVD-2026-59320

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled but no rule is added, fiblookup performs route lookup directly on two tables. Since the first lookup does not properly bail out, the...

CVE-2026-72421

CVE-2026-72421 : In the Linux kernel, a logic flaw in IPv4 route lookup under CONFIG_IP_MULTIPLE_TABLES can cause an error route from a merged local/main table to be overwritten by a route in the default table when no rule is added. The issue occurs in fib_lookup() where two tables are searched a...

CVE-2026-72421 ipv4: fib: Don't ignore error route in local/main tables.

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled but no rule is added, fiblookup performs route lookup directly on two tables. Since the first lookup does not properly bail out, the...

CVE-2026-72421: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled but no rule is added, fiblookup performs route lookup directly on two tables. Since the first lookup does not properly bail out, the...

CVE-2026-74289: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fibinfo in fibleafnotify. syzbot reported use-after-free in nsimfib4prepareevent. 0 The problem is that the following functions call fibinfohold / refcountinc while dumping fibinfo under RCU, which is...

Linux Distros Unpatched Vulnerability : CVE-2026-74289

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: fib: Don't dump dying fibinfo in fibleafnotify. syzbot reported use-after-free in nsimfib4prepareevent. 0 The problem is that the following functions call...

CVE-2026-72450: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrmselectormatch due to AFUNSPEC selector with large prefixlen e.g. 128 matched against IPv4 flow when XFRMSTATEAFUNSPEC is set...

SUSE CVE-2026-73212

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...

Linux ipv4/fou_nl.c DoS

The vulnerability of the ipv4/founl.c component in the Linux operating system is related to resource management errors. Exploiting this vulnerability can allow an attacker to cause service failures...

USN-8637-1: Linux kernel (OEM) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Thunderbolt and USB4 drivers; - Network traffic contro...

CVE-2026-49857

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

CVE-2026-49857

auth-fetch-mcp has an SSRF protection bypass via IPv4-mapped IPv6 loopback. The root cause is in isPrivateV6() handling of hex-normalized IPv4-mapped addresses; input like http://[::ffff:127.0.0.1]:PORT/ becomes http://[::ffff:7f00:1]:PORT/ and net.isIPv4 returns false, allowing requests to priva...

CVE-2026-49857 auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

CVE-2026-73629

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipityurlallowed filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address...

CVE-2026-73629

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipityurlallowed filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-73629 Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipityurlallowed filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address...

CVE-2026-73629 Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipityurlallowed filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address...

CVE-2026-73629 Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipityurlallowed filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address...

EUVD-2026-57798

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipityurlallowed filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address...