Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109805)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109805 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. Tenable has extracted the preceding description block directly from the Unity Linux securi...

GO-2026-6447 LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper

LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper...

GO-2026-6445 LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper

LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper...

GO-2026-6446 LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper

LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper...

CVE-2026-91986

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91986 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91986 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91986 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91839

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed CR/LF characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile...

CVE-2026-91986: Improper Neutralization of Special Elements in Output Used by a Downstream Component

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

PT-2026-98966

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

There is a use-after-free in iouring in the Linux kernel. The signalfdpoll and binderpoll functions use a waitqueue whose lifetime is the current task. The waitqueue will send a POLLFREE notification to all waiters before it is freed. Unfortunately, the iouring poll does not handle POLFREE. This...

SUSE CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2025-24979

creationtimestamp| type| source ---|---|--- 2026-09-09 19:05:37+00:00| published-proof-of-concept| https://github.com/lf-edge/ekuiper/security/advisories/GHSA-pqqc-8v73-9gg2...

CVE-2025-24978

creationtimestamp| type| source ---|---|--- 2026-09-09 18:35:56+00:00| published-proof-of-concept| https://github.com/lf-edge/ekuiper/security/advisories/GHSA-g8rh-fjm6-h2h9...

CVE-2025-58363

creationtimestamp| type| source ---|---|--- 2026-09-09 18:35:22+00:00| published-proof-of-concept| https://github.com/lf-edge/ekuiper/security/advisories/GHSA-c23q-fw86-9h5x...

LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. Details In internal/plugin/native/manager.go, the plugin installation endpoint...

GHSA-PQQC-8V73-9GG2 LF Edge eKuiper: SSRF in External Service

Summary Server-side request forgery SSRF vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces localhost, or cloud...

GHSA-G8RH-FJM6-H2H9 LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

Linux Distros Unpatched Vulnerability : CVE-2026-19203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request...