Open Redirect

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Open Redirect via the RelayState parameter, which is used in redirects without proper validation against an allowlist of permitted domains. An attacker...

Directus has open redirect in SAML

Security Advisory: Open Redirect in Directus SAML Authentication Summary An open redirect vulnerability exists in the Directus SAML authentication callback endpoint. The RelayState parameter is used in redirects without proper validation against an allowlist of permitted domains. Vulnerability...

SUSE CVE-2025-12419

Mattermost versions 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12, 11.0.x = 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of...

curl: State Isolation Failure in Multiplexed Connections (Shared Auth Context)

Vulnerability: State Isolation Failure in Multiplexed Connections Shared Auth Context Product: libcurl Affected Versions: v7.43.0 - Current v8.x - All versions supporting HTTP/2 Multiplexing Severity: CRITICAL CVSS: 9.1 1. Executive Summary A fundamental design flaw exists in libcurl's state...

Malicious code in shop-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5afad53032ae0acf7c8b481c6f0bd05fc4a1c283de24285d35b19a376cfa1b10 The package shop-state was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2026-0934

Malicious code in shop-state npm...

MAL-2026-48 Malicious code in shop-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5afad53032ae0acf7c8b481c6f0bd05fc4a1c283de24285d35b19a376cfa1b10 The package shop-state was found to contain malicious code. Source: ossf-package-analysis...

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Summary An unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files e.g., security.json,...

GHSA-W3X5-7C4C-66P9 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Summary An unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files e.g., security.json,...

CVE-2025-66398

Summary (CVE-2025-66398) : Signal K Server (signalk-server) before version 2.19.0 is vulnerable to unauthenticated state pollution via the /skServer/validateBackup endpoint. An attacker can pollute the global restoreFilePath, hijack the administrator’s Restore workflow, and overwrite critical con...

CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

[SECURITY] Fedora 42 Update: golang-github-google-wire-0.6.0-14.fc42

Wire is a code generation tool that automates connecting components using dependency injection. Dependencies between components are represented in Wire as function parameters, encouraging explicit initialization instead of global variables. Because Wire operates without runtime state or reflectio...

PT-2026-26115

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to RCU Read-Copy-Update protection in the /proc/net/ptype interface. Specifically, the functions ptype seq next and ptype seq show do not adhere ...

PT-2026-26134

Name of the Vulnerable Software and Affected Versions nghttp2 versions prior to 1.68.1 Description nghttp2 is a C implementation of the Hypertext Transfer Protocol version 2. Versions of nghttp2 prior to 1.68.1 are susceptible to a denial-of-service condition. This occurs because the library does...

PT-2026-6123

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a deadlock issue involving NFSv4.1 state recovery. The deadlock occurs when kthreadd attempts to reclaim memory by calling the nfs release folio function, which...

PT-2026-8199

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ALSA aloop driver’s PCM trigger callback. The callback attempts to check the PCM state and stop the stream of a tied substream without proper locking,...

PT-2026-8131

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the libceph component of the Linux kernel where the sparse-read state is not properly reset in the osd fault function when a connection fault occurs. This can lead to th...

PT-2026-27741

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the nvmet-fcloop component. Specifically, a missing check for the remoteport port state before invoking the done callback in nvme fc handle ls rqs...

PT-2026-6177

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.19.0-rc1 Description The Linux kernel contains a flaw in the arm64/fpsimd component related to signal handling and the restoration of ZA zeroed address space contexts. The code responsible for restoring a ZA...