Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-47219High· 7.5find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server (CVE-2026-47219)
A flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause …
CVE-2026-64551High· 7.0⚖ disputedkernel: sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP). This vulnerability allows a remote attacker or a local unprivileged user to potentially access and disclose sensitive information. By sending a malformed e…
CVE-2026-64554High· 7.0kernel: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (CVE-2026-64554)
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb…
CVE-2026-64546Medium· 5.5kernel: drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)
A flaw was found in the Linux kernel. A specially crafted Extended Display Identification Data (EDID), which describes display capabilities, can cause a heap out-of-bounds read in the `drm_parse_tiled_block()` function within the `drm/edid…
CVE-2026-64540Medium· 5.5⚖ disputedkernel: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (CVE-2026-64540)
A flaw was found in the Linux kernel's GeneLink (GL620A) USB network driver. A malicious GeneLink device can send specially crafted Universal Serial Bus (USB) packets that cause an out-of-bounds read vulnerability. This can lead to the dis…
CVE-2026-64539High· 7.0kernel: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (CVE-2026-64539)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy pa…
CVE-2026-64536Low· 8.1kernel: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (CVE-2026-64536)
A flaw was found in the Linux kernel rtl8723bs staging Wi-Fi driver. is_ap_in_tkip() reads an information-element header and its vendor or RSN payload without checking that those bytes remain in the buffer, so a truncated element causes an…
CVE-2026-64718Medium· 5.5⚖ disputedA use-after-free issue was addressed with improved memory management
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, Safari 27, iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.6, tvOS 2…
CVE-2026-17527High· 7.7In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone a…
CVE-2026-66053Medium· 5.9thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation (CVE-2026-66053)
A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when…
CVE-2026-43871High· 7.5thrift: Apache Thrift: Denial of Service via infinite loop (CVE-2026-43871)
A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can…
CVE-2026-54272High· 7.2ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifie…
CVE-2026-64531High· 7.8PoCIn the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: op…
CVE-2026-15928High· 7.4XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.
CVE-2026-55685Medium· 6.5react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests (CVE-2026-55685)
A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and…
CVE-2026-53669Medium· 5.4react-router: React Router: Open Redirect vulnerability via backslashes in navigation components (CVE-2026-53669)
A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the <Link> or useNavigate components. This could lead …
CVE-2026-45623High· 7.5postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can l…
CVE-2026-64648High· 7.5next: Next.js: Information disclosure via server-side fetch cache (CVE-2026-64648)
A flaw was found in Next.js. A remote attacker could exploit a vulnerability in the server-side fetch mechanism, where a request with a body might receive a cached response intended for a different request to the same URL but different bod…
CVE-2026-64649High· 8.2next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions (CVE-2026-64649)
A flaw was found in Next.js, a framework for building web applications. A remote attacker can exploit this vulnerability by manipulating Host-associated headers when a Server Action forwards or redirects a request. This can lead to Server-…
CVE-2026-64641High· 7.5next: Next.js: Denial of Service via crafted requests to App Router with Server Actions (CVE-2026-64641)
A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usa…
CVE-2026-64642High· 8.2next: Next.js: Authentication bypass leading to unauthorized access (CVE-2026-64642)
A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerabi…
CVE-2026-64645High· 8.2next: Next.js: Server-Side Request Forgery vulnerability (CVE-2026-64645)
A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) or Open Redirect attacks. When a `rewrites()` or `redirects()` rule con…
CVE-2026-64646High· 7.5next: Next.js: Denial of Service via excessive memory consumption in Server Actions (CVE-2026-64646)
A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a…
CVE-2026-64530High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act…
CVE-2026-64524Medium· 5.5⚖ disputedkernel: drm/hyperv: validate resolution_count and fix WIN8 fallback (CVE-2026-64524)
A flaw was found in the Linux kernel's `drm/hyperv` component. A malicious Hyper-V guest could exploit an out-of-bounds memory access vulnerability by sending a crafted resolution response. This could potentially lead to information disclo…
CVE-2026-64441Low· 8.8kernel: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (CVE-2026-64441)
A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. This vulnerability involves out-of-bounds reads in several functions responsible for parsing information elements (IE) and attributes. Due to missing checks on the size of in…
CVE-2026-64490High· 8.4ALSA: virtio: Validate control metadata from the device
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. Th…
CVE-2026-64481High· 7.8ALSA: hda/cs35l41: Fix firmware load work teardown
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can…
CVE-2026-64475High· 7.0kernel: vfio/pci: Release the VGA arbiter client on register_device() failure (CVE-2026-64475)
A flaw was found in the Linux kernel's vfio/pci subsystem. A missing cleanup operation during device registration could lead to a stale registration and a callback using freed memory. This vulnerability could result in system instability o…
CVE-2026-64448High· 7.0kernel: smb: client: restrict implied bcc[0] exemption to responses without data area (CVE-2026-64448)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. An attacker, by operating a malicious SMB server, could send specially crafted responses during the session negotiation phase. This could cause the client to read be…