CVE-2026-103243 LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints

LightLLM through 1.2.0 fails to validate imageurl and audiourl parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error...

PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

USN-8818-5: Linux kernel (NVIDIA Tegra) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

CVE-2026-92941

A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security TLS module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation...

CVE-2026-92940

A flaw was found in vm2. When a sandbox is configured to permit HTTPS requests, it improperly exposes the host process's network connection manager to sandboxed code. An attacker running untrusted code within the sandbox can exploit this flaw to intercept pooled network connections released by th...

CVE-2026-97990

A flaw was found in the Linux kernel's vHost Data Path Acceleration vDPA network simulator driver. When a packet transmission pull operation fails, a negative error code is improperly treated as an unsigned value, resulting in an excessively large buffer length during receive processing. A local...

USN-8848-1 python-django vulnerabilities

Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write arbitrary files, or execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LT...

USN-8818-4: Linux kernel vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

CVE-2026-97981

A flaw was found in the Cortina Gemini Ethernet driver within the Linux kernel. The network packet receive handler fails to count dropped or malformed packets against its processing budget. An attacker could exploit this vulnerability by sending a stream of invalid network frames, causing the...

CVE-2026-91072

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CVE-2026-97966

A flaw was found in the Linux kernel's Marvell OCTEON TX2 network driver. When tearing down Hierarchical Token Bucket HTB quality-of-service queues, the driver fails to clear hardware scheduler topology configurations before returning queues to the shared pool. A local user with network...

CVE-2026-97963

A flaw was found in the Linux kernel's stmmac network driver. An uninitialized read-write lock is accessed when configuring traffic control scheduling on an interface that has not been brought up. A local user with network administration privileges could exploit this flaw to cause a kernel crash,...

CVE-2026-97962

A flaw was found in the Linux kernel's mlx5 network driver. The driver fails to hold the required lock when destroying virtual network interface health reporters during device unloading. A local user with administrative privileges could trigger this flaw by unbinding the driver, resulting in a...

CVE-2026-97958

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by sending repeated netlink queries to inspect network traffic control chains without reading the responses. When the socket buffer fills, the kernel incorrectly retries the operation in an unbounded loop. This...

CVE-2026-97957

A flaw was found in the Linux kernel's hinic network driver. An attacker with access to send mailbox messages, such as from a guest operating system utilizing a Virtual Function VF, a virtualized network interface, can exploit insufficient validation of message segment lengths. This flaw can caus...

CVE-2026-97956

A flaw was found in the Linux kernel's network failover driver, which can result in a Denial of Service DoS. When a network slave device undergoes a name change, the driver invokes an open operation that attempts to reacquire locks already held by upper-level callers. A local user capable of...

CVE-2026-97955

A flaw was found in the Microsoft Azure Network Adapter MANA driver in the Linux kernel. A local user with network administrative privileges can cause a denial of service DoS or potentially execute arbitrary code due to a use-after-free vulnerability. When attaching an eXpress Data Path XDP progr...

CVE-2026-97953

A flaw was found in the Linux kernel's stmmac network driver. An attacker can cause a Denial of Service DoS by transmitting highly fragmented network packets that use TCP Segmentation Offload TSO. Due to an improper calculation of required transmit descriptors, the driver writes past available...

kernel: net: qrtr: restrict socket creation to the initial network namespace

A flaw was found in the Linux kernel's QRTR Qualcomm IPC Router networking component. An unprivileged local attacker can create a QRTR socket in a separate network namespace. Due to improper handling of global state variables, this allows the attacker to send datagrams and control-plane messages ...

CVE-2026-102105: Server-Side Request Forgery (SSRF)

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...