CVE-2026-65601

creationtimestamp| type| source ---|---|--- 2026-08-05 22:35:12+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj 2026-08-05 23:31:11+00:00| seen| https://gist.github.com/alon710/55629b813908ae24f1e292f2b3f6a8d5 2026-08-06 00:00:17+00:00...

GHSA-QQ9Q-X9W4-CHHJ Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Summary There is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author...

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Summary There is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author...

MINI-785M-H6MW-543V

Bulletin has no description...

MINI-MW7V-VX24-PMQP

Bulletin has no description...

MINI-3VP3-CFXG-F275

Bulletin has no description...

MINI-W4FH-3C4C-44H2

Bulletin has no description...

MINI-JXPX-V692-36MQ

Bulletin has no description...

MINI-XW64-4H99-G7WF

Bulletin has no description...

MINI-6Q85-CVHH-W2PR

Bulletin has no description...

MINI-PPWC-R463-2H8J

Bulletin has no description...

MINI-436X-868W-V65W

Bulletin has no description...

MINI-C5CG-CX46-QFG3

Bulletin has no description...

CVE-2026-64582

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...

MINI-CFCJ-HP6Q-GWV2

Bulletin has no description...

CVE-2026-64580

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

CVE-2026-11454

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...

UBUNTU-CVE-2026-64580

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

EUVD-2026-53274

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

CVE-2026-64580 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...