SUSE CVE-2026-98025

In the Linux kernel, the following vulnerability has been resolved: net: usb: cx82310eth: drop URB after 0xffff reboot sentinel to prevent partialdata heap overflow The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest of...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

CVE-2026-98028

A flaw was found in the Linux kernel's Netronome Flow Processor NFP network driver. When replacing an existing flow steering rule fails during hardware reprogramming, the driver fails to remove the old rule from its internal list, creating an inconsistency with the active rule counter. A local us...

CVE-2026-98026

A flaw was found in the Linux kernel's network bridge subsystem. An attacker could exploit this vulnerability to cause a Denial of Service DoS or system crash through a use-after-free condition. This issue occurs during multicast port group removal, where the kernel immediately frees data...

CVE-2026-98022

A flaw was found in the Linux kernel. Multiple network subsystems allocate memory buffers based on the transmit queue length without enforcing an upper bound. A local unprivileged user can exploit this vulnerability by configuring an excessively large queue length on network devices, exhausting...

CVE-2026-98017

A flaw was found in the Linux kernel's network traffic control subsystem. This flaw allows a local user with network administration privileges to cause a denial of service DoS or potentially escalate privileges. A use-after-free condition occurs when the kernel prematurely deallocates network...

CVE-2026-98016

A flaw was found in the Linux kernel's Mellanox network driver mlx5e. A race condition occurs during the concurrent teardown of traffic control TC sample rules sharing the same context, causing the system to reference memory after it has already been freed. A local user with network administrativ...

CVE-2026-98015

A flaw was found in the Linux kernel's mlx5 driver. A local attacker can cause a Denial of Service DoS via a use-after-free vulnerability in the network switch offload mechanism. This issue arises when concurrent operations race while releasing termination table handles in the mlx5eswitchtermtblp...

CVE-2026-98012

A flaw was found in the Linux kernel's Stochastic Fairness Queueing SFQ network packet scheduling subsystem. A local attacker with network administration privileges, including within an unprivileged user namespace, can supply an improperly bounded quantum parameter alongside a crafted packet size...

CVE-2026-98014

A flaw was found in the Linux kernel's Mellanox network driver mlx5. This vulnerability allows a local privileged user to cause a Denial of Service DoS through a system crash. During hardware reset or error recovery procedures, improper cleanup when disabling a virtual network port leaves stale...

CVE-2026-98013

A flaw was found in the Linux kernel. A local user with network administration privileges, including within a user namespace, can cause a Denial of Service DoS by configuring the Flow Queue Proportional Integral controller Enhanced FQ-PIE packet scheduler with an excessively low quantum value and...

Security Bulletin: Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

Summary Langflow contains multiple Server-Side Request Forgery vulnerabilities across several components where authenticated users can supply attacker-controlled URLs or database connection strings that reach internal network hosts without adequate validation. The LMStudio model and embeddings...

CVE-2026-101910

A flaw was found in ip-address. The address classification mechanism fails to identify the local-use Network Address Translation NAT64 range as private. A remote attacker can exploit this by submitting an internal address formatted within this IPv6 prefix to an application that relies on the...

CVE-2026-101905

A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...

CVE-2026-101913

A flaw was found in ip-address. The library fails to validate the complete range of IPv6 link-local addresses during address classification checks. A remote attacker can provide a specially crafted IPv6 address to bypass security controls that rely on this verification. Successful exploitation ca...

CVE-2026-55160

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

CVE-2026-49994

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994

Bluehood , a local Bluetooth activity monitor, is vulnerable to an authentication bypass in versions prior to 0.7.1 . When auth_enabled is active, only HTML page handlers enforce session validation; however, the */api/ handlers (including settings, devices, groups, and per-device endpoints like /...