EUVD-2026-90381

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...

EUVD-2026-90372

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102091 Kiteworks Secure Data Forms server-side request forgery

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102091

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to a Server-Side Request Forgery (SSRF) . This flaw allows an unauthenticated, remote attacker to compel the server to issue arbitrary outbound network requests and read back the responses. Such exploitation could enable the attacker ...

CVE-2026-100076

A flaw was found in the Linux kernel's rtl8723bs wireless network driver. When handling wireless management frames under certain error conditions, the driver fails to release allocated transmission frames and buffers back to their memory pools. An attacker within radio range could send unexpected...

CVE-2026-46711

In Soft Machine versions 0.2.247 and prior , the workspace HTTP service listening on 0.0.0.0:8080 within sm-ws- Fly Machines * lacks authentication and origin checks. This vulnerability allows any host capable of reaching TCP/8080 to access endpoints such as /health, /file/, and /archive/. Conseq...

CVE-2026-46711 Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-46711 Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Image Optimization remote fetch, which resolves and requests an allowlisted remote URL without constraining the address that name resolves to, so a host permitted by...

recce

recce Pentest enumeration, vulnerability triage, exploitation...

SUSE CVE-2026-74225

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the...

CVE-2026-103243 LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints

LightLLM through 1.2.0 fails to validate imageurl and audiourl parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error...

CVE-2026-103243 LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints

LightLLM through 1.2.0 fails to validate imageurl and audiourl parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error...

PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

USN-8818-5: Linux kernel (NVIDIA Tegra) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

CVE-2026-92941

A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security TLS module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation...

CVE-2026-92940

A flaw was found in vm2. When a sandbox is configured to permit HTTPS requests, it improperly exposes the host process's network connection manager to sandboxed code. An attacker running untrusted code within the sandbox can exploit this flaw to intercept pooled network connections released by th...

CVE-2026-97990

A flaw was found in the Linux kernel's vHost Data Path Acceleration vDPA network simulator driver. When a packet transmission pull operation fails, a negative error code is improperly treated as an unsigned value, resulting in an excessively large buffer length during receive processing. A local...

USN-8848-1 python-django vulnerabilities

Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write arbitrary files, or execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LT...

USN-8818-4: Linux kernel vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...