CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

PT-2026-89176

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.1 Description An issue exists where the platform incorrectly identifies certain internal addresses as external by relying solely on Python's globally routable address classification. This allows an authenticat...

SUSE CVE-2026-56867

reserved but not needed...

SUSE CVE-2026-56868

reserved but not needed...

SUSE CVE-2026-56869

reserved but not needed...

SUSE CVE-2026-56870

reserved but not needed...

SUSE CVE-2026-56871

reserved but not needed...

SUSE CVE-2026-56872

reserved but not needed...

SUSE CVE-2026-56873

reserved but not needed...

SUSE CVE-2026-56874

reserved but not needed...

SUSE CVE-2026-80874

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller protects DRAM content using inline ECC. The inline ECC utilizes areas of DRAM for its operation, which are in the DRAM address range, but must...

CVE-2026-80874 arm64: dts: renesas: ironhide: Describe inline ECC carveouts

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller protects DRAM content using inline ECC. The inline ECC utilizes areas of DRAM for its operation, which are in the DRAM address range, but must...

CVE-2026-80874

This CVE affects the Linux kernel on the arm64 Renesas ironhide platform. The DBSC5 DRAM controller uses inline ECC, which relies on specific DRAM address ranges that must not be accessed by the OS. The vulnerability is a device tree (dts) omission : the inline ECC carveout areas were not describ...

EUVD-2026-71504

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller protects DRAM content using inline ECC. The inline ECC utilizes areas of DRAM for its operation, which are in the DRAM address range, but must...

CVE-2026-80874 arm64: dts: renesas: ironhide: Describe inline ECC carveouts

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller protects DRAM content using inline ECC. The inline ECC utilizes areas of DRAM for its operation, which are in the DRAM address range, but must...

PT-2026-85793

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture for Renesas ironhide where inline ECC carveouts are not properly described as reserved memory. The DBSC5 DRAM controller uses specific areas of...

DEBIAN-CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory

FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...

SUSE CVE-2026-74352

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: avoid post-init UAF when allocreservedmemarray fails The global pointer 'reservedmem' continues to reference the reservedmemarray which lives in initdata if allocreservedmemarray fails. ofreservedmemlookup is...

CVE-2024-3773

The LiveJournal Shortcode WordPress plugin through version 1.1.1 fails to validate and escape certain shortcode attributes before outputting them in a page or post. This allows users with the Contributor role or above to inject arbitrary JavaScript, resulting in a Stored Cross-Site Scripting (XSS...