EUVD-2026-39226

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being...

CVE-2026-53275

The CVE-2026-53275 entry describes a Linux kernel IPv6 multicast (mcast) use-after-free in MLD query processing. Specifically, while handling an MLD query, a pointer to the multicast group address is obtained during initial parsing but is later dereferenced after pskb_may_pull() may have realloca...

CVE-2026-53266

CVE-2026-53266 concerns the Linux kernel netfilter bridge (ebt_snat ARP rewrite) where the ARP sender hardware address rewrite could be written via skb_store_bits() into a non-writable area. The fix ensures the ARP SHA range is writable before reading the ARP header and before performing the writ...

EUVD-2026-39210

In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under idev-lock syzbot reported a splat 1: a slab-use-after-free in ipv6chkacastaddr, which walks the global inet6acaddrlst hash under RCU and dereferences a struct ifacaddr6 that has...

CVE-2026-53256

CVE-2026-53256 addresses a Linux kernel Bluetooth RFCOMM use-after-free condition. In rfcomm_get_sock_by_channel(), the listener is selected while holding rfcomm_sk_list.lock but is returned after the lock is dropped and without a reference. rfcomm_connect_ind() then locks the listener, queues a ...

CVE-2026-53253

The CVE-2026-53253 entry concerns the Linux kernel Bluetooth BNEP path. A short BNEP SDU could be processed without validating required bytes in bnep_rx_frame and bnep_rx_control, leading to a potential access of unverified data (KASAN). The fix adds proper length validation by using skb_pull_dat...

EUVD-2026-39200

In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPTSSRR and IPOPTLSRR options This patch restricts setting Loose Source and Record Route LSRR and Strict Source and Record Route SSRR IP options to users with CAPNETRAW capability. This prevents unprivileged...

CVE-2026-53249

In the Linux kernel, CVE-2026-53249 affects the IPv4 handling of LSRR and SSRR options. The implemented patch restricts setting IPOPT_SSRR and IPOPT_LSRR to users with CAP_NET_RAW, preventing unprivileged applications from steering traffic through attacker-controlled nodes to leak TCP ISN and pot...

EUVD-2026-39197

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIEECHO processing When a listening SCTP server processes a COOKIEECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked b...

EUVD-2026-39329

In the Linux kernel, the following vulnerability has been resolved: netlabel: validate unlabeled address and mask attribute lengths netlblunlabeladdrinfoget used the address attribute length to determine whether the attribute data could be read as an IPv4 or IPv6 address, but did not independentl...

EUVD-2026-39326

In the Linux kernel, the following vulnerability has been resolved: net: add pskbmaypull to skbgroreceivelist skbgroreceivelist calls skbpullskb, skbgrooffsetskb without first ensuring the data is in the linear area via pskbmaypull. When the skb arrives via napigrofrags, skbheadlen can be 0 all...

CVE-2026-53222

The CVE-2026-53222 entry concerns the Linux kernel PTP subsystem (ptp: ocp). The vulnerability arises from an incorrect order of resource freeing and unregistration during driver removal: ptp_ocp_detach() freed resources before ptp_clock_unregister(), creating a use-after-free condition. The fix ...

EUVD-2026-39277

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRPRSP sense copy by the received length srpprocessrsp copies sense data from rsp-data + respdatalen, where respdatalen is the full 32-bit value supplied by the SRP target and is never checked against the number o...

CVE-2026-53184

The CVE describes a Linux kernel bug on the UDP receive path when a socket is in a sockmap. skb->dev is repurposed as dev_scratch and is not cleared before running the attached SK_SKB verdict program; if the verdict calls socket-lookup helpers (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp), skb-&...

CVE-2026-53176

CVE-2026-53176 affects the Linux kernel ISERT driver (drivers/infiniband/ulp/isert/ib_isert.c). The vulnerability arises in isert_login_recv_done() where the login request payload length is computed as wc->byte_len minus ISER_HEADERS_LEN without a lower bound. A remote iSER initiator can send ...

EUVD-2026-39241

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tbpropertyentryvalid accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the...

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

Astro - Unauthorized Third-Party Image Access

Astro 5.13.2 and 4.16.18 contains an information disclosure vulnerability caused by improper validation of protocol-relative URLs in the image optimization endpoint, letting attackers serve images from unauthorized third-party domains, exploit requires on-demand rendering deployment. id:...

Oracle WebLogic Server - Remote Code Execution

Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 contains a remote code execution caused by unauthenticated access via T3, IIOP, letting attackers take over the server, exploit requires network access. id: CVE-2021-2135 info: name: Oracle WebLogic Server - Remote Code Execution author:...

BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure

Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files. id: CVE-2019-25246 info: name: BEWARD...