CVE-2026-92395

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

CVE-2026-92395 @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

CVE-2026-92395 @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

EUVD-2026-80806

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

CVE-2026-92395

@fastify/proxy-addr (a Fastify plugin for determining client IP behind reverse proxies) is vulnerable to IP spoofing in versions 3.0.0 through 5.1.0. The root cause: an IPv4-mapped IPv6 trust subnet with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of /104) is accepted silently but effec...

Security update for openvpn

This update for openvpn fixes the following issues: CVE-2026-63650: OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field bsc1275310. CVE-2026-84732: Remote Denial of Service via crafted...

SUSE-SU-2026:4213-1 Security update for openvpn

This update for openvpn fixes the following issues: - CVE-2026-63650: OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field bsc1275310. - CVE-2026-84732: Remote Denial of Service via...

SUSE-SU-2026:4210-1 Security update for alloy

This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

CVE-2026-90007

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The rollback loop uses the failing index i for every iteration instead of th...

DEBIAN-CVE-2026-90007

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The rollback loop uses the failing index i for every iteration instead of th...

CVE-2026-90015

In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...

CVE-2026-90007 scsi: pm8001: Use rollback index when freeing MSI-X vectors

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The rollback loop uses the failing index i for every iteration instead of th...

EUVD-2026-80615

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The rollback loop uses the failing index i for every iteration instead of th...

CVE-2026-90007

This vulnerability affects the pm8001 SCSI host controller driver in the Linux kernel . In pm8001_request_msix(), when request_irq() fails, the rollback loop that frees previously registered MSI-X vectors incorrectly uses the failing index i on every iteration instead of the already registered ve...

CVE-2026-90007 scsi: pm8001: Use rollback index when freeing MSI-X vectors

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The rollback loop uses the failing index i for every iteration instead of th...

CVE-2026-89856 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha-msixcount is u16, but ha-maxreqqueues, ha-maxrspqueues and ha-maxqpairs are u8. Deriving the queue count as "ha-maxreqqueues = ha-msixcount - 1" therefore...

EUVD-2026-80456

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha-msixcount is u16, but ha-maxreqqueues, ha-maxrspqueues and ha-maxqpairs are u8. Deriving the queue count as "ha-maxreqqueues = ha-msixcount - 1" therefore...

CVE-2026-89856

A vulnerability in the Linux kernel qla2xxx SCSI driver arises from a type-width mismatch: ha->msix_count is u16 while derived queue counts (max_req_queues, max_rsp_queues, max_qpairs) are u8 . A device (physical or hot-plugged) advertising 257 MSI-X vectors causes msix_count - 1 to equal 256,...

EUVD-2026-80448

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxxdeleteqpair deletes the request queue before the response queue. qla25xxdeletereqque frees the request queue memory kfreereq in qla25xxfreereqque, but the...

PT-2026-93910

Name of the Vulnerable Software and Affected Versions @redocly/cli versions prior to 2.33.2 Description The split command constructs output paths under the --outDir parameter using untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values. Because the software fails to verify th...