CVE-2026-33237

WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's run function in plugin/Scheduler/Scheduler.php calls urlgetcontents with an admin-configurable callbackURL that is validated only by isValidURL URL format check. Unlike other AVideo endpoints that were...

CVE-2026-33237 AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation

WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's run function in plugin/Scheduler/Scheduler.php calls urlgetcontents with an admin-configurable callbackURL that is validated only by isValidURL URL format check. Unlike other AVideo endpoints that were...

Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC

Versions - effect: 3.19.15 - @effect/rpc: 0.72.1 - @effect/platform: 0.94.2 - Node.js: v22.20.0 - Vercel runtime with Fluid compute - Next.js: 16 App Router - @clerk/nextjs: 6.x Root cause Effect's MixedScheduler batches fiber continuations and drains them inside a single microtask or timer...

Race Condition

Overview org.webjars.npm:effect is a node package that allows you to add effects on images. Affected versions of this package are vulnerable to Race Condition in the MixedScheduler class, where the AsyncLocalStorage context is not properly isolated between concurrent fiber executions. An attacker...

AZL-80204 CVE-2026-23277 affecting package kernel for versions less than 6.6.130.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnelxmit on TEQL slave xmit teqlmasterxmit calls netdevstartxmitskb, slave to transmit through slave devices, but does not update skb-dev to the slave device beforehand. When a...

CVE-2026-23277

In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnelxmit on TEQL slave xmit teqlmasterxmit calls netdevstartxmitskb, slave to transmit through slave devices, but does not update skb-dev to the slave device beforehand. When a...

AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation

Summary The Scheduler plugin's run function in plugin/Scheduler/Scheduler.php calls urlgetcontents with an admin-configurable callbackURL that is validated only by isValidURL URL format check. Unlike other AVideo endpoints that were recently patched for SSRF GHSA-9x67-f2v7-63rw,...

GHSA-V467-G7G7-HHFH AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation

Summary The Scheduler plugin's run function in plugin/Scheduler/Scheduler.php calls urlgetcontents with an admin-configurable callbackURL that is validated only by isValidURL URL format check. Unlike other AVideo endpoints that were recently patched for SSRF GHSA-9x67-f2v7-63rw,...

Server-side Request Forgery (SSRF)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the run function of the Scheduler plugin when the callbackURL parameter is not properly validated against internal or private...

PT-2026-26316

Summary The Scheduler plugin's run function in plugin/Scheduler/Scheduler.php calls url get contents with an admin-configurable callbackURL that is validated only by isValidURL URL format check. Unlike other AVideo endpoints that were recently patched for SSRF GHSA-9x67-f2v7-63rw,...

UBUNTU-CVE-2026-23245

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgate: snapshot parameters with RCU on replace The gate action can be replaced while the hrtimer callback or dump path is walking the schedule list. Convert the parameters to an RCU-protected snapshot and swap update...

CVE-2026-23245

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgate: snapshot parameters with RCU on replace The gate action can be replaced while the hrtimer callback or dump path is walking the schedule list. Convert the parameters to an RCU-protected snapshot and swap update...

The vulnerabilities of the functions drm_sched_entity_kill_jobs_cb() and drm_sched_entity_kill_jobs() in the drivers/gpu/drm/scheduler/sched_entity.c file of the Direct Rendering Infrastructure (DRI) driver in the Linux operating system allow a malicious actor to cause a service failure.

The vulnerabilities of the functions drmschedentitykilljobscb and drmschedentitykilljobs in the drivers/gpu/drm/scheduler/schedentity.c file of the Direct Rendering Infrastructure DRI driver in the Linux kernel are related to improper memory release mechanisms memory leaks. Exploiting these...

The vulnerability of the drm_sched_entity_kill_jobs_cb() function in the drivers/gpu/drm/scheduler/sched_entity.c file of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the drmschedentitykilljobscb function in the drivers/gpu/drm/scheduler/schedentity.c file of the Linux operating system is related to errors during thread blocking. Exploiting this vulnerability could allow an attacker to cause a service failure...

Security Bulletin: Multiple Vulnerabilities in IBM Workload Scheduler component of IBM Workload Automation

Summary Multiple vulnerabilities were addressed in IBM Workload Scheduler component of IBM Workload Automation 10.2.5 Vulnerability Details CVEID:CVE-2024-21094 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause no confidentiali...

Security Bulletin: Multiple Vulnerabilities in IBM Workload Scheduler component of IBM Workload Automation

Summary Multiple vulnerabilities were addressed in IBM Workload Scheduler component of IBM Workload Automation 10.1.0.5 and 10.2.3 Vulnerability Details CVEID:CVE-2023-32342 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel...

Security Bulletin: Multiple Vulnerabilities in IBM Workload Scheduler Container component of IBM Workload Automation Container

Summary Multiple vulnerabilities were addressed in IBM Workload Scheduler Container component of IBM Workload Automation Container 10.1.0.6 and 10.2.5 Vulnerability Details CVEID:CVE-2023-6597 DESCRIPTION: An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions...

The vulnerability of the drm_sched_job_add_resv_dependencies() function in the drivers/gpu/drm/scheduler/sched_main.c file of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the drmschedjobaddresvdependencies function in the drivers/gpu/drm/scheduler/schedmain.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to the reallocation of previously released memory. Exploiting this vulnerability could allo...

The vulnerability of the task_can_attach() function in the kernel/sched/core.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the taskcanattach function in the kernel/sched/core.c module of the Linux operating system is related to the execution of operations outside of memory buffers. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1455)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1455 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields CVE-2025-38591 In the Linux kernel, the following vulnerability has been...