ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

Important: Red Hat Security Advisory: nodejs22 security update

An update for nodejs22 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

A flaw was found in the Certificate Management Protocol CMP implementation within OpenSSL. An attacker with existing Registration Authority RA level credentials could exploit an error in the certificate verification process during a Root Certificate Authority CA key update. This vulnerability...

ALSA-2026:55541 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

Exploit for CVE-2026-8508

CVE-2026-8508: Zyxel Captive-Portal Bypass via Trusted Browser...

CVE-2026-18500

CVE-2026-18500 concerns the @fastify/jwt plugin for Fastify. In versions before 10.2.2, a per-request key passed to request.jwtVerify({ key }) can be silently overridden by the plugin’s globally configured secret due to the option merge applying the global key last. This allows an ordinary authen...

UBUNTU-CVE-2026-72097

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...

CVE-2026-72380

Technical details are not publicly available in the provided documents; monitor for updates.

EUVD-2026-59023

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted...

PT-2026-72286

In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dm verity loadpin is bdev trusted if the device has no table...

CVE-2026-47192

CVE-2026-47192 affects kas (bitbake project setup tool). From 4.8 up to 5.3, kas may checkout and process repositories for configuration includes before validating signatures, under very specific conditions. If an attacker controls a referenced repository and the victim’s kas config includes a fi...

CVE-2026-49986

Summary: CVE-2026-49986 describes a local arbitrary code execution in the Cortex MCP server (neuro-cortex-memory) prior to version 3.17.1. The root cause is permissive validation in _find_dev_source()/ _is_cortex_root(): the code trusts the CLAUDE_PROJECT_DIR environment variable (set by Claude C...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

GO-2025-3487 vulnerabilities

Vulnerabilities for packages: terraform-provider-tls, crossplane-provider-aws-dynamodb, crossplane-provider-aws-cloudfront, crossplane-provider-aws-eks, gcsfuse, gobuster, kubernetes-dashboard-api, hugo-extended, ksops, openbao-k8s, local-static-provisioner, kapp-controller, kine, osv-scanner,...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-72809 SiYuan before v3.7.4 Authentication Bypass via Localhost Trust

SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1 for a specific set of endpoints including /api/system/exit,...