Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Image Optimization remote fetch, which resolves and requests an allowlisted remote URL without constraining the address that name resolves to, so a host permitted by...

recce

recce Pentest enumeration, vulnerability triage, exploitation...

SUSE CVE-2026-74225

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the...

CVE-2026-103243 LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints

LightLLM through 1.2.0 fails to validate imageurl and audiourl parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error...

CVE-2026-103243 LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints

LightLLM through 1.2.0 fails to validate imageurl and audiourl parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error...

PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

USN-8818-5: Linux kernel (NVIDIA Tegra) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

CVE-2026-92941

A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security TLS module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation...

CVE-2026-92940

A flaw was found in vm2. When a sandbox is configured to permit HTTPS requests, it improperly exposes the host process's network connection manager to sandboxed code. An attacker running untrusted code within the sandbox can exploit this flaw to intercept pooled network connections released by th...

CVE-2026-97990

A flaw was found in the Linux kernel's vHost Data Path Acceleration vDPA network simulator driver. When a packet transmission pull operation fails, a negative error code is improperly treated as an unsigned value, resulting in an excessively large buffer length during receive processing. A local...

USN-8848-1 python-django vulnerabilities

Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write arbitrary files, or execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LT...

USN-8818-4: Linux kernel vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

CVE-2026-97981

A flaw was found in the Cortina Gemini Ethernet driver within the Linux kernel. The network packet receive handler fails to count dropped or malformed packets against its processing budget. An attacker could exploit this vulnerability by sending a stream of invalid network frames, causing the...

CVE-2026-91072

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CVE-2026-97966

A flaw was found in the Linux kernel's Marvell OCTEON TX2 network driver. When tearing down Hierarchical Token Bucket HTB quality-of-service queues, the driver fails to clear hardware scheduler topology configurations before returning queues to the shared pool. A local user with network...

CVE-2026-97963

A flaw was found in the Linux kernel's stmmac network driver. An uninitialized read-write lock is accessed when configuring traffic control scheduling on an interface that has not been brought up. A local user with network administration privileges could exploit this flaw to cause a kernel crash,...

CVE-2026-97962

A flaw was found in the Linux kernel's mlx5 network driver. The driver fails to hold the required lock when destroying virtual network interface health reporters during device unloading. A local user with administrative privileges could trigger this flaw by unbinding the driver, resulting in a...

CVE-2026-97958

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by sending repeated netlink queries to inspect network traffic control chains without reading the responses. When the socket buffer fills, the kernel incorrectly retries the operation in an unbounded loop. This...

CVE-2026-97957

A flaw was found in the Linux kernel's hinic network driver. An attacker with access to send mailbox messages, such as from a guest operating system utilizing a Virtual Function VF, a virtualized network interface, can exploit insufficient validation of message segment lengths. This flaw can caus...

CVE-2026-97956

A flaw was found in the Linux kernel's network failover driver, which can result in a Denial of Service DoS. When a network slave device undergoes a name change, the driver invokes an open operation that attempts to reacquire locks already held by upper-level callers. A local user capable of...