A deadlock vulnerability was identified and fixed in the Linux kernel's GPIO shared proxy implementation. The issue involved an overly broad critical section protecting the offset field in the gpio_shared_entry structure, which could cause a deadlock during the removal of the shared GPIO proxy's parent. The fix reduces the critical section to only protect the offset field when it is read and updates documentation to clarify locking behavior.
CVE-2026-64233 is a Linux kernel vulnerability in the USB gadget UVC function binding code. It involves a race condition due to missing locking around extension unit list walks during function bind operations. This can lead to dereferencing freed memory if a privileged user concurrently modifies configfs entries while binding the UVC function. The issue affects only privileged processes with configfs mount and gadget UDC write permissions and is considered a correctness fix rather than a security boundary bypass.
CVE-2026-65315 is a high-severity vulnerability in Ollama's GGUF metadata parser that allows remote attackers to cause a server crash by uploading a crafted GGUF file. The flaw arises from uncontrolled memory allocation using attacker-controlled length and count fields without validation, leading to Go runtime out-of-memory fatal errors or panics that crash the server process.
MediaCMS version 8.2.0 has an information disclosure vulnerability that allows authenticated users to access private media metadata of other users. By adding arbitrary media tokens to their own playlist via a PUT request to the playlist API, attackers can bypass ownership validation and retrieve sensitive fields such as title, description, view count, like count, file size, author username, and encoding status. This flaw arises from missing access control checks on media tokens in playlist operations.
Huginn versions before 2026.09.09 contain a server-side request forgery (SSRF) vulnerability in the fetch_url method of ScenarioImport. This flaw allows authenticated users to craft URLs that trigger arbitrary HTTP requests from the server. Exploitation can lead to probing of internal network services, port enumeration through error messages, and access to cloud metadata endpoints, potentially exposing sensitive credentials. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity). A fix is available in version 2026.09.09.
CVE-2026-9323 is a critical vulnerability in the urwid library where the web session identifiers are generated using Python's Mersenne Twister PRNG, which is not cryptographically secure. This weakness allows an attacker to reconstruct the internal PRNG state after observing approximately 334 session IDs, enabling prediction of past and future session IDs. Additionally, session IDs are used as filenames for FIFOs in a world-listable /tmp directory, allowing local users to enumerate active sessions. Exploitation can lead to reading the victim's terminal screen, injecting keystrokes to execute code with the victim's privileges, or crashing the session. A prior security warning was suppressed rather than addressed. A patch is available, and the vulnerability affects urwid version 0.
SurrealDB versions from 3.0.0 up to but not including 3.1.5 have an authorization flaw where field-level SELECT permissions are not enforced on ORDER BY clauses. This allows authenticated users to infer the relative ordering of restricted field values, potentially leaking information about those fields even though the field values themselves are returned as null.
SigNoz versions before 0.134.0 have an open redirect vulnerability in the SSO authentication flow. This flaw allows unauthenticated attackers to craft login URLs that redirect victims to attacker-controlled sites, enabling theft of session tokens for users on instances configured with Google OAuth, SAML, or OIDC. The vulnerability is fixed in version 0.134.0.
CVE-2026-63089 affects wg-easy versions up to 15.3.0 and involves a cryptographically weak pseudo-random number generator used for one-time link token generation. This vulnerability allows unauthenticated attackers to brute-force tokens due to a limited keyspace of 1000 values and lack of rate limiting or token expiration validation. Exploitation enables recovery of WireGuard peer credentials, including PrivateKey and PresharedKey, allowing impersonation of peers on the VPN network. The issue was fixed in commit 66b292b.
A Server-Side Request Forgery (SSRF) vulnerability exists in stoatchat versions before 0.14.0. This flaw allows unauthenticated attackers to bypass a DNS-based IP blocklist due to incomplete address validation in the url_is_blacklisted function. The function only checks the first resolved IP address, while the HTTP client processes all cached addresses. The issue is fixed in version 0.14.0.
CVE-2026-58658 is a high-severity vulnerability in GPUStack versions up to 2.2.1 that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration. The flaw arises from missing authentication on the /serveLogs and /debug endpoints, enabling attackers to enumerate model instance IDs, stream logs containing prompts and completions, change log levels, and read memory profiling data. This vulnerability was fixed in a commit identified as 4e20551.
Crawl4AI versions before 0.8.7 have a path traversal vulnerability in the Docker API server's /screenshot and /pdf endpoints. The vulnerability allows arbitrary file writes via the output_path parameter, which lacks proper validation. An attacker can supply absolute or path-traversal paths to overwrite files accessible by the application's user, potentially causing denial of service.
RustDesk versions prior to 1.4.9 contain a missing authorization vulnerability where the server does not enforce session scope restrictions. This allows a peer with limited session permissions (such as FileTransfer, PortForward, ViewCamera, or Terminal) to send control messages and login options reserved for full Remote sessions. An authenticated remote peer can exploit this flaw to perform actions beyond their granted permissions, potentially observing and controlling the host improperly.
HestiaCP versions before 1.9.5 contain a stored cross-site scripting (XSS) vulnerability. Authenticated low-privilege users can inject arbitrary HTML by creating a DNS record with a crafted value containing a double-quote and script payload. The vulnerability arises because the application does not properly encode the DNS record value when rendering it into an HTML attribute, allowing script execution in the browsers of users who view the DNS record list, including administrators. This issue is fixed in version 1.9.5.
HestiaCP versions prior to 1.9.5 contain an authenticated OS command injection vulnerability. This flaw allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. The vulnerability arises from insufficient input validation combined with unsafe eval-based parsing, enabling full root code execution during DNS record creation. The issue is fixed in version 1.9.5.
Crawl4AI versions before 0.8.7 have a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints. These endpoints accept webhook URLs without validating their destination, allowing attackers to make the server send requests to internal or private network addresses, including cloud metadata endpoints. This could lead to exposure of sensitive internal services or cloud metadata.
CVE-2026-60120 is a stored cross-site scripting (XSS) vulnerability in Webkul Bagisto versions before 2.4.4. It allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by injecting malicious payloads into customer first or last name fields during account registration. The vulnerability arises because the create.blade.php template renders these fields without the Vue.js v-pre directive, causing Vue.js to interpret stored template expressions as executable code when administrators open the Create Order page for the affected customer.
Zeek versions prior to 8.0.9 contain a null pointer dereference vulnerability in the Kerberos protocol analyzer. This flaw allows unauthenticated remote attackers to crash the Zeek sensor by sending a specially crafted KRB_ERROR message with specific PA-DATA elements. The vulnerability arises from a parser and analyzer state mismatch in proc_padata(), leading to dereferencing an uninitialized field and causing a crash. The issue can be triggered by a single UDP or TCP packet to port 88 without requiring any credentials or prior authentication. The vulnerability is fixed in Zeek 8.0.9.
Zeek versions before 8.0.9 have a vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause a denial of service by sending a crafted FTP control session. The flaw is due to uncontrolled memory consumption triggered by a large ADAT control line during AUTH GSSAPI negotiation, which causes the internal buffer to grow without limits during base64 decoding.
CVE-2026-59704 is a vulnerability in Cap's GET /api/video/ai endpoint where the system fails to verify user ownership or membership before disclosing private AI-generated video metadata. Authenticated attackers can access sensitive content such as titles, summaries, and chapters of videos they do not own. Additionally, attackers can trigger unauthorized AI generation that consumes the video owner's credits without their consent.