Improper Input Validation

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Improper Input Validation via the API checkout process. An attacker can corrupt asset records and audit trails by submitting POST requests with soft-deleted user, asset, or...

CVE-2026-86768

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

undici: undici: Denial of Service due to orphaned response body in retry handler

A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici's retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to...

EUVD-2026-74945

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86768 Snipe-IT before 8.7.0 Improper Input Validation via API Checkout

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-18149

A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici's retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to...

DEBIAN-CVE-2026-18149

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status...

CVE-2026-18149

undici 's RetryHandler can leave an already-exposed response body orphaned when a server sends a partial body with a declared Content-Length, closes the connection, and the retry returns a non-retryable status (e.g., 400). The original body stream is neither ended nor destroyed, so reads on it ne...

CVE-2026-18149 undici vulnerable to Denial of Service via orphaned RetryHandler response body

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status...

CVE-2026-18149 undici vulnerable to Denial of Service via orphaned RetryHandler response body

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status...

CVE-2026-18149 undici vulnerable to Denial of Service via orphaned RetryHandler response body

undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status...

Linux Distros Unpatched Vulnerability : CVE-2026-18149

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length,...

Linux Distros Unpatched Vulnerability : CVE-2026-5038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipa...

CVE-2026-82236 File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: Rejection of re-registration of an already-bound ops. The ioinstallbpf function only rejects a second registration on the ctx-bpfops side and unconditionally sets the per-map back-pointer ops-priv. The structops...

SUSE CVE-2026-77584

Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...

CVE-2026-77584

Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...

PT-2026-79132

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.4.9.10 Description The software fails to reject a CONFLUX LINK cell when it arrives on a circuit that already has attached streams. A malicious client can send a RELAY COMMAND BEGIN before the CONFLUX LINK on the same...

CVE-2026-72112

In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: reject re-registration of an already-bound ops ioinstallbpf only rejects a second registration on the ctx side ctx-bpfops and sets the per-map back-pointer ops-priv unconditionally. The structops link path never...

undici: undici: Denial of Service due to orphaned response body in retry handler

A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici's retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to...