CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit, 8c30b0018f9d “openrisc: Add jump label support”, copied from arm64 and did not properly account for how icache invalidation operates on remote cores in OpenRISC. On OpenRIS...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: ti-vpe: cal: Fixed a NULL pointer dereference in calctxv4l2initformats. In calctxv4l2initformats, devmkzalloc is assigned to ctx-activefmt, and there is a dereference of it afterward. This could lead to a NULL pointer...

PT-2026-80795

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-41843

CVE-2026-41843...

CVE-2026-74699

A memory leak was identified in the Linux kernel's drm/xe driver (Intel Xe GPU), specifically in the function exec_queue_set_hang_replay_state() . The root cause is that q->replay_state is blindly overwritten, potentially leaking memory previously allocated by vmemdup_user(). The fix returns a...

EUVD-2026-64386

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in execqueuesethangreplaystate The q-replaystate is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdupuser. Return an error if q-replaystate is not empty...

gha-oidc-auditor

gha-oidc-auditor !Licensehttps://img.shields.io/badge/lic...

SUSE CVE-2026-68242

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix NULL deref on schedengine alloc failure Avoid using intelcontextput before intelcontextinit in execlistscreatevirtual as the krefput inside would lead to NULL deref on the IOCTL path when schedengine allocation...

SUSE CVE-2026-68247

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...

SUSE CVE-2026-75904

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...

Linux Distros Unpatched Vulnerability : CVE-2026-15743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control heade...

CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

UBUNTU-CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-15743 Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-15743

The Catalyst::Plugin::Static::Simple component in Perl (versions through 0.38 ) contains a flaw where the _serve_static method incorrectly sets the Cache-Control header to public for all responses without providing a means to override it. This misconfiguration can lead to unauthorized information...

EUVD-2026-63534

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...