GHSA-2R5C-GW76-RH3W Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Summary Gitea's default SSRF allow-list MatchBuiltinExternal, used by both webhook delivery and repository migrations relies on Go's standard library net.IP.IsPrivate, which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal...

CVE-2026-64119 l2tp: use list_del_rcu in l2tp_session_unhash

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

EUVD-2026-45804

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

CVE-2026-63918 l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcountincnotzero in l2tpsessiongetbyifname A reader in l2tpsessiongetbyifname can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcountinc, but every other...

CVE-2026-63918

CVE-2026-63918 documents a Linux kernel fix: l2tp_session_get_by_ifname previously used refcount_inc() while other getters used refcount_inc_not_zero(), risking use-after-free if a race during RC/Rcu grace period allowed a zero refcount. The change normalizes the getter to refcount_inc_not_zero()...

PT-2026-61235

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the l2tp session get by ifname function. A reader matching session-ifname can be preempted between the strcmp and refcount inc operations. If the last referenc...

PT-2026-61436

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unprivileged local user can cause a host CPU to pin indefinitely. This occurs when L2TP CMD SESSION GET is issued on L2TP ATTR IFNAME concurrently with L2TP CMD SESSION CREATE and L2T...

SUSE-SU-2026:22697-1 Security update for the Linux Kernel RT (Live Patch 23 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-46.1 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094....

CVE-2026-50694

Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...

CVE-2026-50694 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

...

SUSE-SU-2026:22777-1 Security update for the Linux Kernel RT (Live Patch 6 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats...

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...

PT-2026-58214

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description A use after free issue in the Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network. Use after free is a memory corruption fla...

Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...

MAL-2026-10489 Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...

Malicious code in @car_loans/dealerships-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d @carloans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json...

MAL-2026-10397 Malicious code in @car_loans/dealerships-approval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326f8f463729022112e04c36fd7a67e785ad8fc37f8e7eec19f60738597bd43d @carloans/dealerships-approval 7.1.5 self-describes as a 'browserslist config' but ships a heavily obfuscated postinstall dropper. package.json...

FTP Fetch, Windows shellcode stage, Reverse HTTP Stager Proxy

Fetch and execute an x86 payload from an FTP server. Custom shellcode stage. Tunnel communication over HTTP Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options

A flaw was found in sshd, the OpenSSH server daemon. When DisableForwarding=yes is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over PermitTunnel=yes. This allows a remote attacker to bypass intended security restrictions and establish a tunnel,...

CVE-2026-59999

A flaw was found in sshd, the OpenSSH server daemon. When DisableForwarding=yes is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over PermitTunnel=yes. This allows a remote attacker to bypass intended security restrictions and establish a tunnel,...