92 matches found
CVE-2026-90403
CVE-2026-90403 affects the Linux kernel's rtlwifi PCI driver . In the last error path of rtl_pci_probe(), a wrong goto label causes cleanup functions to be skipped, leaving previously successful calls to rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one() unreverted. The fix updat...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: In md/raid10, the issue of null-ptr-deref in raid10syncrequest has been fixed. In initresync, the mempool is initialized, and conf-havereplacemnt is set to 0 at the beginning of the sync process. closesync frees the mempool when...
CVE-2026-85184
@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...
CVE-2026-74250
A flaw was found in OpenStack Ironic. The autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface. This can lead to operational issues where necessary cleaning procedures are not executed. Mitigation Use an explicit...
UBUNTU-CVE-2026-74250
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface...
CVE-2025-59324
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped...
CVE-2025-59324
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped...
CVE-2025-59327
In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped...
CVE-2026-18569 Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...
CVE-2026-18569 Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...
CVE-2026-18568 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...
CVE-2026-12817 OpenPGP AEAD decryption skips final tag on chunk-aligned data
In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...
PT-2026-64439
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.9.9 Description An authenticated user can overwrite the content of messages in channels they do not belong to, including private and direct message channels. This occurs when a chat completion request is sen...
CVE-2026-44982
CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from maxr.ContentLength, 0, so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length...
SUSE-SU-2026:3043-1 Security update for curl
This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. - CVE-2026-8458: wrong reuse for different services bsc1268407. - CVE-2026-8924: traling dot domain super cookie bsc1268409. - CVE-2026-8927: env-set cross-proxy Digest auth state leak...
Malicious code in ai-pro-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...
JLSEC-2026-671
wolfSSL before 5.4.0 allows remote attackers to cause a denial of service via DTLS because a check for return-routability can be skipped...
MAL-2026-10075 Malicious code in testudo-pack (npm)
The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...
CVE-2026-55436 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy aibridgeproxyd created a goproxy server whose default transport set InsecureSkipVerify: true and only assigned a...
