CVE-2026-53398

A flaw was found in the Linux kernel's Network File System Daemon NFSD. The nfsd4decodesecinfononame function does not properly initialize a pointer sinexp before processing an incoming data stream. If the data stream is malformed or truncated, the uninitialized pointer can retain stale data from...

CVE-2026-53391

A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. CVE-2025-71302: drm/panthor: fix for dma-fence safe access...

CVE-2026-64622

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-64623

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature...

CVE-2026-63744

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to...

CVE-2026-64157

A flaw was found in the Linux kernel's network file system netfs component. This vulnerability allows for incorrect handling of data during partial invalidation operations on streaming-write pages. An attacker could potentially exploit this to cause data corruption or unexpected system behavior,...

CVE-2026-64623 Network-AI before 5.13.4 Cryptographic Signature Verification Bypass

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature...

CVE-2026-64623

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter, where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature ver...

CVE-2026-64623 Network-AI before 5.13.4 Cryptographic Signature Verification Bypass

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature...

EUVD-2026-45937

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-64622 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-64622 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-64622

Network-AI (npm: network-ai) versions 5.12.2–5.13.3 are affected by missing authorization on the ApprovalInbox read routes. Specifically, the GET routes /approvals/?status=all, /approvals/:id, /approvals/stats, and /approvals/sse fail to apply the configured authorization check (checkAuth/secret)...

CVE-2026-63744

SurrealDB prior to 3.1.5 contains a server-side request forgery in the JWKS fetcher that follows HTTP redirects without re-validating targets against network capabilities. With Owner privileges, an attacker can configure a JWKS URL that redirects to blocked internal addresses, bypassing network a...

CVE-2026-63744 SurrealDB before 3.1.5 SSRF via JWKS URL Redirect

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to...

CVE-2026-63744 SurrealDB before 3.1.5 SSRF via JWKS URL Redirect

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle MITM attack. This enables the attacker to intercept, read, and modify all...

CVE-2026-64058

A flaw was found in the Linux kernel's network file system netfs component. The netfsreadfolio function fails to wait for ongoing writeback operations to complete. This can lead to the system incorrectly trusting the dirty flag and prematurely cleaning up private data associated with a folio,...