CVE-2026-72761

The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32 are classified as globally routable by IANA, so isglobal returns True even when...

CVE-2026-68083

In the Linux kernel, CVE-2026-68083 affects ksmbd’s path resolution in ksmbd_vfs_kern_path_create. The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the create/mkdir/hardlink path was built from an absolute path using convert_to_unix_name() and resolved from AT_FDCWD, allowing ...

EUVD-2026-55264

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

EUVD-2026-54208

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...

SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3521-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3521-1 advisory. Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...

CVE-2026-16552

REJECTED A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats...

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and...

CVE-2026-64576

A flaw was found in the Linux kernel. During nexthop resolution, an uninitialized variable is used if a memory allocation fails. This can lead to the system attempting to access uninitialized stack memory, causing a general protection fault and a kernel panic. This vulnerability results in a Deni...

SUSE-SU-2026:3521-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

CVE-2026-71318

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the as prop in server island components that forward attacker-controlled values into dynamic component resolution. An attacker can instantiate any...

EUVD-2026-53647

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

CVE-2026-71318 Nuxt: Unauthorized Component Instantiation via Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

CVE-2026-71318

Nuxt (Vue.js framework) is affected in versions 3.1.0 through 3.21.10 and 4.5.1 where a top-level as prop to the /__nuxt_island/ endpoint can drive dynamic component resolution via , resolveDynamicComponent, or h(). This allows potential unauthorized component instantiation as described in the CV...

CVE-2026-71318 Nuxt: Unauthorized Component Instantiation via Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

CVE-2026-20313

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

CVE-2026-20310

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

CVE-2026-20313

CVE-2026-20313 relates to memory corruption vulnerabilities in Cisco Catalyst SD-WAN components stemming from improper link resolution before file access (CWE-1284). The connected CVE records reference Cisco’s internal security hardening releases addressing multiple previously discovered issues. ...

CVE-2026-20313

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...