UBUNTU-CVE-2026-82247

gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...

The vulnerability of the Open vSwitch software-based multi-level switch lies in the reading of data beyond the allowed buffer limits, which allows a hacker to cause a service failure.

The vulnerability of the Open vSwitch multi-level switch lies in reading data from buffers beyond their acceptable limits. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

The vulnerability of the Open vSwitch multi-level switch software lies in the fact that an operation outside the buffer boundaries in memory can lead to a service failure for the attacker.

The vulnerability of the Open vSwitch multi-level switch lies in the fact that the output of operations goes beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Spring Framework 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

The version of Spring Framework installed on the remote host is 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities: - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies...

PT-2026-83366

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.9.0 IGEL OS 12 version 12.8.3 LTS IGEL OS 11 versions prior to 11.11.150 Description A secure boot bypass exists in the GRUB boot stage. A physically present attacker can gain unauthorized root access by placing...

PT-2026-83257

Name of the Vulnerable Software and Affected Versions Pocket ID versions 2.6.0 through 2.8.0 Description The OIDC authorization page in the frontend redirects the browser to an attacker-controlled URL without consulting the backend redirect URI allow-list when the request uses prompt=none. An...

EUVD-2026-63467

WebOb: Open redirect in Location header normalization via leading C0 control / space characters...

GHSA-6HX8-3WJJ-GR8G WebOb: Open redirect in Location header normalization via leading C0 control / space characters

Summary This is a third follow-up to CVE-2024-42353 / GHSA-mg3v-6m49-jhp3 and CVE-2026-44889 / GHSA-fh3h-vg37-cc95. WebOb makes the Location header absolute when it serves a redirect. To stop a relative or protocol-relative target from redirecting users off-host, it checks the value for a URI...

USN-8658-4 linux-azure-fde-5.15 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Open vSwitch; - SCTP protocol; CVE-2026-53224, CVE-2026-53246, CVE-2026-64531...

USN-8658-4: Linux kernel (Azure CVM) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Open vSwitch; - SCTP protocol; CVE-2026-53224, CVE-2026-53246, CVE-2026-64531...

USN-8643-5: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network drivers; - Open vSwitch; - SCTP protocol; CVE-2026-53224, CVE-2026-53246, CVE-2026-53247, CVE-2026-64531...

USN-8643-5 linux-azure-6.8, linux-ibm, linux-ibm-6.8, linux-oracle-6.8, linux-raspi, linux-raspi-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network drivers; - Open vSwitch; - SCTP protocol; CVE-2026-53224, CVE-2026-53246, CVE-2026-53247, CVE-2026-64531...

GHSA-G7GW-M874-7RMF Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Summary The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's...

EUVD-2026-28857

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter...

OpenClaw went viral. Meet the maintainers building and securing it.

What began as a personal experiment quickly became a global open source project with extraordinary momentum. OpenClaw is a personal AI assistant that runs on users' devices and connects with the messaging channels they already use. Started by Peter Steinberger as a weekend project in November 202...

CVE-2026-54770

A flaw was found in WebOb, a library for HTTP requests and responses. This vulnerability allows an unauthenticated attacker to bypass URL validation checks by injecting leading control characters or spaces into a redirect target. This can lead to an open redirect, enabling attackers to send users...

Two Alleged ‘TeamPCP’ Hackers Arrested in Australia

Authorities in Australia have arrested two men believed to be members of TeamPCP , a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police AFP said two men...

CVE-2026-59355

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

CVE-2026-80585

A flaw was found in the Linux kernel. In the Multipath TCP MPTCP Fast Open feature, a vulnerability exists where the system incorrectly marks a subflow as MPTFO even when a TCP Fast Open TFO SYN packet does not contain data. This can lead to a stale MPTFO state, potentially triggering a...

CVE-2026-59355

Spring Authorization Server versions 1.5.0 through 1.5.7 are affected by an open redirect vulnerability in the authorization endpoint . The root cause is insufficient validation of the request_uri parameter : an attacker can craft a request containing an invalid request_uri paired with an unvalid...