GHSA-43GM-9RR3-CX7G Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Summary A stored Cross-Site Scripting XSS vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access customer role to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of an affected domain, the...

CVE-2026-49852

A flaw was found in the joserfc Python library. A remote attacker can exploit a vulnerability in the joserfc.jwt.decode function to forge HMAC-signed tokens. This occurs because the library accepts tokens signed with an empty or null verification key, allowing an attacker to bypass integrity...

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

Impact Prior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice. Patches The bug has been patched starting with version 6.2.9...

GHSA-PR85-W493-9W3X resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

Impact Prior to version 6.2.9 resdata would not correctly validate input in GRDECL files. The severity rating assumes that resdata is used to parse untrused files in a networking context such as a webservice. Patches The bug has been patched starting with version 6.2.9...

CVE-2026-72283

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem. This vulnerability occurs when the system fails to update an Interrupt Remapping Table Entry IRTE for a bypass operation, which can leave a pointer to a memory location that has already been freed a 'dangling...

DEBIAN-CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

Security update for erlang

This update for erlang fixes the following issues: CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. CVE-2026-42790: Name...

SUSE-SU-2026:3645-1 Security update for erlang

This update for erlang fixes the following issues: - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. - CVE-2026-42790:...

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

EUVD-2026-61142

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502

In openapi3filter/req_resp_decoder.go (~line 197), defaultContentParameterDecoder dereferences mt.Schema.Value without a nil check, panicking on any spec using a schema-less content parameter. Unauthenticated clients trigger this with one request, causing per-request aborts or full process crashe...

CVE-2026-72241

A flaw was found in the kernel. In the leds: uleds module, a buffer overread can occur because the name string provided by userspace is not guaranteed to be null-terminated. This can lead to a local attacker potentially reading sensitive information from adjacent memory or causing a denial of...

CVE-2026-72235

A flaw was found in the Linux kernel batman-adv component. The batadvinterfacerx function, responsible for handling network packets, can reallocate its internal buffer. However, a pointer to the ethernet header is not correctly updated after this reallocation. This oversight leads to a...

CVE-2026-72234

A flaw was found in the Linux kernel's batman-adv module. When the pskbmaypull function is called by batadvgetvid, it can reallocate a buffer. However, a pointer to the old buffer, specifically unicastpacket, was not correctly reassigned, leading to a use-after-free condition. This memory...

GHSA-W26R-FWG8-RCP3 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

Summary MagicMirror applies ipWhitelist only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface...

MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

Summary MagicMirror applies ipWhitelist only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface...