UBUNTU-CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

CVE-2026-16552

The CVE-2026-16552 entries describe a vulnerability in systemd-tmpfiles: when processing tmpfiles.d entries that write to a file, an unprivileged local user can cause systemd-tmpfiles to follow a symbolic link, potentially redirecting a privileged write to an attacker-controlled file. The highest...

Cross-site Scripting (XSS)

Astro is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper HTML escaping of user-controlled values in transition:persist, transition:scope, and transition:persist-props directives, which allows an attacker to inject arbitrary HTML or JavaScript into the server-rendered...

Improper Encoding or Escaping of Output

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the transition:persist, transition:scope, or transition:persist-props directives when...

GHSA-7PW4-F3Q4-R2P2 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Summary When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these...

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Summary When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these...

GHSA-4G3V-8H47-V7G6 Astro: Reflected XSS via unescaped View Transition animation properties

Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an animation property such as duration can contain a sequence, terminate the generated sty...

PT-2026-61807

Name of the Vulnerable Software and Affected Versions Astro versions 3.10.0 through 7.0.3 Description Astro fails to HTML-escape values for specific transition directives when applied to client-hydrated components. This occurs within the generateHydrateScript function, where the transition:persis...

EUVD-2026-45583

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64010

CVE-2026-64010 involves a use-after-free in the Linux NFC LLCP stack. The race occurs when nfc_llcp_recv_cc() moves a socket from the connecting_sockets list to the sockets list without holding the socket lock, risking linking a freed socket if llcp_sock_release() runs concurrently. The mitigatio...

CVE-2026-64010 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-63913

The CVE-2026-63913 entry concerns the Linux kernel netfilter conntrack TCP state machine. A crafted RST with an invalid SEQ after observing a SYN could transition the conntrack entry to TCP_CONNTRACK_CLOSE, even if the RST is not a valid response to the observed SYN or its direction. This could p...

PT-2026-61327

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NFC LLCP connection state machine. The issue occurs when a connection acceptance packet CC is processed concurrently with a socket release, potentially...

CVE-2026-48014

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/action/order/orderId/state/transition and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare...

CVE-2026-48014

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/action/order/orderId/state/transition and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare...

CVE-2026-48014 Shopware: Admin API ACL Bypass in Order State Transition Endpoints

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/action/order/orderId/state/transition and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare...

Server-side Request Forgery (SSRF)

Overview phanan/koel is a personal audio streaming service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the isPublicHost process. An attacker can access internal resources and retrieve sensitive information by supplying a specially crafted podcast...

Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

Summary Koel's outbound-URL guard App\Helpers\Network::isPublicHost classifies an IP as "public" using PHP's filtervar$ip, FILTERVALIDATEIP, FILTERFLAGNOPRIVRANGE | FILTERFLAGNORESRANGE. That flag set does not recognise IPv6 transition-address forms that embed a private/loopback/link-local IPv4:...

GHSA-RJG7-R26H-CFP2 Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

Summary Koel's outbound-URL guard App\Helpers\Network::isPublicHost classifies an IP as "public" using PHP's filtervar$ip, FILTERVALIDATEIP, FILTERFLAGNOPRIVRANGE | FILTERFLAGNORESRANGE. That flag set does not recognise IPv6 transition-address forms that embed a private/loopback/link-local IPv4:...

PT-2026-60386

Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.1 Description An authenticated user can perform a server-side request forgery SSRF by subscribing to a malicious podcast RSS feed. The application's outbound-URL guard AppHelpersNetwork::isPublicHost uses filter var...