CVE-2026-74741

A flaw was found in the Linux kernel's ngbe network driver. In systems configured for non-MSI-X interrupt handling, such as legacy INTx or single MSI modes, a missing initialization of a pointer can lead to a NULL pointer dereference. This vulnerability can cause the system to crash, resulting in...

EUVD-2026-66571

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...

OPENSUSE-SU-2026:21663-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - Update to version 2.98.0: chore: fix extra whitespace Default Codespaces port forwarding to loopback Bump gh-aw-actions to v0.87.1 and recompile workflows Fix issue triage action compatibility choredeps: bump golang.org/x/crypto from...

OPENSUSE-SU-2026:21662-1 Security update for glab

This update for glab fixes the following issues: Changes in glab: - Update to version 1.114.0: featapi: support dynamic custom headers for authenticating proxies featartifact-registry: add glab artifact-registry login --docker featartifact-registry: resolve artifact registries in the Docker...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2026-74741

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...

UBUNTU-CVE-2026-74741

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...

CVE-2026-74741

CVE-2026-74741 is a NULL pointer dereference in the Linux kernel's ngbe network driver, occurring in the non-MSI-X interrupt enabling path. When the driver operates in legacy INTx or single MSI mode, the wx->msix_entry pointer is not allocated or initialized, so calling NGBE_INTR_MISC(wx) dere...

CVE-2026-74741 net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...

CVE-2026-74741 net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2026-80349

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

EUVD-2026-66388

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349

TarsWeb through 3.0.14 contains a critical authentication bypass (CVSS 9.8). The root cause is a combination of two misconfigurations: Koa's proxy option is set to true without restricting trusted upstream proxies, so the source address is taken from the caller-controlled X-Forwarded-For header; ...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098837)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098837 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guar...

PT-2026-82121

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the ngbe driver during non-MSI-X interrupt enabling, such as in legacy INTx or single MSI modes. The issue arises because wx-msix entry is not...