Threat database

This entry reports multiple vulnerabilities in the Linux kernel as used in Debian. The Linux kernel is the core component of the operating system. No specific details about the vulnerabilities, affected versions, or impacts are provided.

CVE-2026-31683 is a high-severity vulnerability in the Linux kernel's batman-adv module. It involves improper handling of packet aggregation when the socket buffer (skb) tailroom is insufficient, potentially causing buffer overflow conditions. The issue occurs when OGM aggregation state is toggled at runtime, leading to appending packets beyond allocated space. The fix prevents aggregation if the skb tailroom cannot accommodate the new packet, avoiding overflow by creating a new forward packet instead.

Saltcorn versions prior to 1.4.6, between 1.5.0-beta.0 and before 1.5.6, and between 1.6.0-alpha.0 and before 1.6.0-beta.5 contain a critical SQL injection vulnerability in the mobile-sync routes. This flaw allows any authenticated user with low privileges and read access to at least one table to inject arbitrary SQL commands. Exploitation can lead to full database exfiltration, including sensitive data such as admin password hashes and configuration secrets, and may also permit modification or destruction of the database depending on the backend. The vulnerability is fixed in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.

Deskflow versions 1.20.0, 1.26.0.134, and earlier contain a vulnerability where the daemon runs as SYSTEM and exposes an IPC named pipe with world-accessible permissions. This allows any local unprivileged user to send privileged commands without authentication, resulting in arbitrary command execution as SYSTEM.

CVE-2026-41476 is a classic buffer overflow vulnerability in Deskflow, a keyboard and mouse sharing application. Versions prior to 1.26.0.138 are affected. The flaw arises from improper validation during clipboard deserialization, allowing a connected peer to trigger an out-of-bounds read by sending a malformed clipboard update. This vulnerability is fixed in Deskflow version 1.26.0.138.

An out-of-bounds read vulnerability exists in bacnet-stack versions 1.4.0 up to but not including 1.4.3. The flaw occurs in the ReadPropertyMultiple service property decoder, where a specially crafted BACnet/IP packet with a truncated property list can cause the decoder to read beyond allocated buffer boundaries. This can lead to crashes on embedded BACnet devices. The vulnerability is fixed in version 1.4.3.

An out-of-bounds read vulnerability (CWE-125) exists in bacnet-stack versions 1.4.0 up to but not including 1.4.3. The flaw occurs in the ReadPropertyMultiple service decoder where a crafted request with a truncated object identifier causes the code to read one byte beyond the allocated buffer. This can lead to crashes on embedded BACnet devices. The issue is fixed in version 1.4.3.

An out-of-bounds read vulnerability exists in bacnet-stack versions 1.4.0 up to but not including 1.4.3. The flaw occurs in the WritePropertyMultiple service decoder due to improper bounds checking in a deprecated function, allowing unauthenticated remote attackers to read beyond allocated buffer boundaries by sending a truncated request. This can lead to crashes or information disclosure on embedded BACnet devices. The issue is fixed in version 1.4.3.

Budibase versions prior to 3.35.4 contain an improper authentication vulnerability due to unanchored regular expressions in the authenticated middleware. This flaw allows attackers to bypass authentication by appending a public endpoint path as a query parameter to protected endpoints. The issue is fixed in version 3.35.4.

CVE-2026-41426 is a cross-site scripting (XSS) vulnerability in pretalx, a conference planning tool. Before version 2026.1.0, an unauthenticated attacker could embed malicious HTML or markdown in user-controlled template placeholders, such as account display names. This allows the attacker to send arbitrary HTML-rendered emails from the pretalx instance's configured sender address. The vulnerability is exploitable via the password-reset flow, enabling phishing attacks that pass SPF/DKIM/DMARC validation. The issue is fixed in pretalx version 2026.1.0.

Authlib versions prior to 1.6.11 lack Cross-Site Request Forgery (CSRF) protection on the cache feature within authlib.integrations.starlette_client.OAuth. This vulnerability allows an attacker to potentially perform unauthorized actions via forged requests. The issue is addressed in version 1.6.11.

Kata Containers versions 3.4.0 through 3.28.0 contain a vulnerability in the CopyFile policy that allows untrusted hosts to write to arbitrary locations inside the guest workload image. This flaw can be exploited to overwrite binaries and exfiltrate data from containers, including those running inside Confidential Virtual Machines (CVMs). The issue is fixed in version 3.29.0.

Axios versions prior to 1.15.1 and 0.31.1 contain a vulnerability in their XSRF token protection logic. The issue arises because the withXSRFToken configuration property is evaluated using JavaScript truthy/falsy semantics rather than strict boolean comparison. This flaw can cause the same-origin check to be bypassed, resulting in XSRF tokens being sent to cross-origin servers, potentially controlled by attackers. The vulnerability is fixed in versions 1.15.1 and 0.31.1.

Axios versions prior to 1.15.1 and 0.31.1 contain a vulnerability in the toFormData function, which recursively processes nested objects without a depth limit. This can cause a Node.js process to crash with a RangeError when deeply nested request data is sent, resulting in a denial of service (DoS). The issue is fixed in versions 1.15.1 and 0.31.1.

Axios versions prior to 1.15.1 and 0.31.1 have a vulnerability when using responseType: 'stream'. In these versions, Axios returns the response stream without enforcing the maxContentLength limit, allowing unbounded downstream consumption of response data. This issue is addressed in versions 1.15.1 and 0.31.1.

Axios versions prior to 1.15.1 and 0.31.1 contain a vulnerability where the maxBodyLength limit is bypassed for stream request bodies when maxRedirects is set to 0. This allows oversized streamed uploads to be sent fully despite strict body size limits configured by the caller. The issue is fixed in versions 1.15.1 and 0.31.1.

Axios versions from 1.0.0 up to but not including 1.15.1 contain a CRLF injection vulnerability in the FormDataPart constructor. This occurs because the value.type property of a Blob/File-like object is directly interpolated into the Content-Type header of multipart form-data parts without sanitization of CRLF sequences. An attacker controlling this property can inject arbitrary MIME part headers, bypassing Node.js v18+ header protections. The issue is fixed in version 1.15.1.

Axios versions prior to 1.15.1 and 0.31.1 contain a server-side request forgery (SSRF) vulnerability due to incomplete hostname normalization in the no_proxy setting. Specifically, when no_proxy=localhost is configured, requests to loopback IP addresses like 127.0.0.1 and [::1] do not bypass the proxy as intended, because the shouldBypassProxy() function performs only string matching without resolving IP aliases or loopback equivalents. This flaw allows potential SSRF attacks. The vulnerability is fixed in versions 1.15.1 and 0.31.1.

Axios versions prior to 1.15.1 and 0.31.1 are vulnerable to a Prototype Pollution attack that allows manipulation of the Object.prototype.validateStatus property. This causes all HTTP error responses (e.g., 401, 403, 500) to be treated as successful responses, bypassing application-level authentication and error handling. The vulnerability is fixed in versions 1.15.1 and 0.31.1.

Axios versions prior to 1.15.1 and 0.31.1 contain a vulnerability that allows an attacker controlling the target URL to bypass NO_PROXY protections by using addresses in the 127.0.0.0/8 range except 127.0.0.1. This flaw is an incomplete fix of a previous vulnerability and can lead to unauthorized access or information disclosure within internal networks.