EUVD-2026-55274

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

CVE-2026-68173 ublk: wait on ublk_dev_ready() instead of ub->completion

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

CVE-2026-68173

CVE-2026-68173 affects the Linux kernel ublk subsystem. The root cause is that ub->completion is an edge-triggered latch used as a proxy for the readiness condition; when a server sends END_USER_RECOVERY without a preceding START_USER_RECOVERY, the wait can be satisfied by a stale completion, ...

EUVD-2026-55547

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

EUVD-2026-55502

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

CVE-2026-68101

CVE-2026-68101 affects the Linux kernel DRM/amdgpu path. The vulnerability arises in amdgpu_hmm_invalidate_gfx where, briefly during alloc/free, the userptr BO is not part of the VM, making bo->vm_bo potentially NULL. The fix keeps a reference to the VM root page directory as the parent of the...

EUVD-2026-55265

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

CVE-2026-72591

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72588

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...

CVE-2026-72583

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

CVE-2026-72575

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...

kernel: iio: event: Fix event FIFO reset race

A flaw was found in the Linux kernel's Industrial I/O IIO event subsystem. A local user can exploit a race condition during the reset of the event FIFO First-In, First-Out buffer. This occurs when another thread accesses a newly allocated file descriptor before the FIFO reset is complete. This ca...

CVE-2026-72594 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

EUVD-2026-55164

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

CVE-2026-72594

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

CVE-2026-72594

CVE-2026-72594 affects lobehub/lobe-chat up to v2.2.13. The vulnerability is a stored XSS where a low-privileged authenticated user can inject arbitrary JavaScript by uploading a crafted SVG as a user avatar. The avatar upload handler derives the stored file extension and S3 content type from the...

CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72591

The CVE-2026-72591 entry describes a server-side request forgery (SSRF) in the gabehf/Koito project up to v0.3.2. An authenticated user can supply a crafted image_url in PATCH /apis/web/v1/album/{id}/image, causing the server to perform HTTP requests to arbitrary internal or external hosts. The i...

CVE-2026-72591

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...