A vulnerability in the Linux kernel version 6.13 affects x86 memory management on AMD F15h processors, specifically Carrizo and FX-8370E models. The issue involves incorrect application of virtual address alignment (va_align) to hugetlb mappings, causing vm_unmapped_area() to return addresses misaligned to huge page boundaries. This misalignment triggers a kernel BUG_ON during huge page teardown, potentially leading to system instability or crashes. The flaw has been fixed in specific commits addressing the alignment logic for hugetlbfs mappings.
A vulnerability in the Linux kernel's Thunderbolt driver allows access to a DisplayPort (DP) tunnel after its DPRX read operation was canceled. This occurs because the code checks a cancellation flag without proper locking, leading to callbacks on tunnels that have already been torn down during system suspend or disconnect. The issue has been fixed by adding proper locking and flag management to prevent accessing inactive tunnels.
A Linux kernel vulnerability in the net/sched subsystem's act_ct module caused the kernel to WARN on benign failures of flow_offload_alloc(), which can occur under normal load conditions. This WARN could lead to a kernel panic if panic_on_warn=1 is set, allowing an unprivileged user to crash the system by racing a conntrack flush against a tc action ct commit classifier. The issue has been fixed by removing the unnecessary WARN without changing existing error handling behavior.
CVE-2026-98543 is a vulnerability in the Linux kernel affecting version 6.15 where BPF LSM programs attached to certain path hooks can mutate inode extended attributes (xattrs) without holding the required inode lock. This occurs because the path_unlink and path_rmdir hooks run before the inode's i_rwsem lock is acquired, violating locking assumptions. The issue has been fixed by removing these hooks from the set that assume the inode is locked, ensuring the locking variants of BPF functions are used instead.
A vulnerability in the Linux kernel's nouveau DRM driver caused an incorrect increment of the pin count on a failed re-pin operation in nouveau_bo_pin_locked(). This leads to a warning triggered in ttm_bo_release() due to an inconsistent pin count. The issue was discovered through fuzzing and has been fixed in subsequent kernel commits.
A vulnerability in the Linux kernel's KVM arm64 implementation caused a WARN on unknown VM ioctl calls in protected mode. This could lead to a kernel panic if userspace issues an unrecognized ioctl, potentially tainting and crashing the pKVM host under panic_on_warn conditions. The issue was fixed in specific commits.
A vulnerability in the Linux kernel's XFS filesystem code could cause an integer underflow in the xfs_metafile_resv_init function, leading to incorrect space accounting. This occurs when the reserved metadata blocks fall below the space already used, causing a subtraction of an excessively large amount of space. The issue has been fixed by correcting the logic that adjusts available blocks and fixing an adjacent comment error.
A vulnerability in the Linux kernel's XFS filesystem repair code could cause memory allocation failures to leak blocks and disrupt filesystem repairs. The issue arises because the code cannot both undo transactions and return errors properly, potentially leading to filesystem downtime. The fix involves changing the allocation method to avoid failure in a small memory reservation, preventing the problem.
A vulnerability in the Linux kernel's XFS filesystem code was fixed where the dquot flush lock was not properly released if the associated buffer could not be found during a flush operation. This could lead to a lock being held indefinitely, potentially causing resource contention or deadlocks.
If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.
The `annotation-xml` tag has slightly different behavior than the other "integration point"
tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly
strip the namespace-incompatible tags.
This vulnerability only has an effect when the `math` and `annotation-xml` tags
are both enabled, but the `encoding` attribute is disabled, because it relies
on the following sequence of steps:
1. User writes code like `<math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>`.
2. Namespace filtering checks the DOM, and it passes. `<gadget>` is parsed as HTML.
3. Attribute filter strips it down to `<math><annotation-xml><gadget></annotation-xml></math>`. Because the encoding attribute is gone, `<gadget>` is now parsed as MathML.
4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.
Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML.
These [elements] are:
* title
* textarea
* xmp
* iframe
* noembed
* noframes
* plaintext
* noscript
* style
* script
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.
[elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs
### Impact
Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those.
### Patches
- https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3)
- https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2)
- https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2)
### Workarounds
Call <code>builder.[add_clean_content_tags](https://docs.rs/ammonia/latest/ammonia/struct.Builder.html#method.add_clean_content_tags)("annotation-xml")</code> to remove the annotation-xml element and all of its children, including the XSS gadget.
This vulnerability in the Linux kernel's mac80211 wireless subsystem involves an unnecessary warning triggered when an IBSS (ad-hoc) network has no channel to scan due to regulatory domain changes. The warning occurs because the regulatory domain can change while the IBSS is operating, leaving no allowed channels temporarily during a 60-second grace period before shutdown. The issue has been resolved by removing this warning in such cases.
A vulnerability in the Linux kernel's mac80211_hwsim component could cause a warning condition when frames are handed to mac80211 during radio stop. This occurs due to a race condition where the radio can be stopped after a check but before frame delivery, triggering a WARN_ON condition. The issue has been fixed by expanding mutex protection to synchronize frame delivery with radio stopping, preventing the warning. The fix also removes an error print that complicated error handling.
CVE-2026-89310 is a critical SQL injection vulnerability in JTL SW GmbH's JTL-WMS product. It arises because a parameter from the request body is directly inserted into a T-SQL statement without proper parameterization or escaping. This flaw allows a remote attacker to execute arbitrary SQL commands with the application's database privileges. The vulnerability affects multiple versions prior to 2.0.7, 2.1.3, and 2.2.1. The CVSS 4.0 score is 9.4, indicating a high severity with network attack vector and no user interaction required.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
### Summary
`dio_http2_adapter` follows HTTP `Location` redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin `302` redirect receives the victim's `Authorization`, `Cookie`, and `Proxy-Authorization` headers verbatim. This vulnerability has a CVSS v3.1 base score of **7.5 (High)** because `followRedirects` is enabled by default, no authentication is required to exploit it, and the confidentiality impact is high.
### Details
When `Dio` is configured to use `Http2Adapter`, the adapter's internal `_fetch` method constructs HTTP/2 request headers by unconditionally copying all entries from `options.headers`:
```dart
// plugins/http2_adapter/lib/src/http2_adapter.dart:111
headers.addAll(
options.headers.entries.map((entry) {
...
return Header.ascii(entry.key.toLowerCase(), v);
}).toList(),
);
```
On receiving a `3xx` response, the adapter reads the `Location` header and resolves the redirect target URI:
```dart
// plugins/http2_adapter/lib/src/http2_adapter.dart:254-263
final url = responseHeaders.value('location');
final uri = Uri.parse(url ?? '');
final String path = resolveRedirectUri(options.uri, uri).toString();
return _fetch(options.copyWith(path: path, maxRedirects: --options.maxRedirects), ...);
```
`options.copyWith` is called without an explicit `headers` argument; `dio/lib/src/options.dart:629` therefore preserves the full original header map via `headers ?? Map.from(this.headers)`. `resolveRedirectUri` (`http2_adapter.dart:290`) returns an attacker-controlled cross-origin URI without any origin comparison. The combination means that on every redirect, the full set of original sensitive headers — including `Authorization`, `Cookie`, and `Proxy-Authorization` — is forwarded to the new authority with no sanitization.
**Data flow (source → sink):**
1. `dio/lib/src/dio_mixin.dart:383` — public `Dio.request<T>(String path, ...)` entry point.
2. `dio/lib/src/options.dart:331` — base and per-request headers merged into `RequestOptions`.
3. `dio/lib/src/dio_mixin.dart:596` — `httpClientAdapter.fetch(reqOpt, ...)` dispatches to `Http2Adapter`.
4. `plugins/http2_adapter/lib/src/http2_adapter.dart:254` — `Location` header is read from the network response (attacker-controlled source).
5. `plugins/http2_adapter/lib/src/http2_adapter.dart:258` — redirect target URI resolved; cross-origin check absent.
6. `plugins/http2_adapter/lib/src/http2_adapter.dart:260` — `options.copyWith(path: path, ...)` called without `headers` override.
7. `dio/lib/src/options.dart:629` — `copyWith` preserves `Map.from(this.headers)` — all sensitive headers retained.
8. `plugins/http2_adapter/lib/src/http2_adapter.dart:111` — preserved headers emitted verbatim to the cross-origin HTTP/2 request (sink).
**Suggested patch** — strip sensitive headers before following a cross-origin redirect:
```diff
--- a/plugins/http2_adapter/lib/src/http2_adapter.dart
+++ b/plugins/http2_adapter/lib/src/http2_adapter.dart
+ static const _sensitiveRedirectHeaders = {
+ 'authorization',
+ 'cookie',
+ 'proxy-authorization',
+ };
+
- final String path = resolveRedirectUri(options.uri, uri).toString();
+ final redirectUri = resolveRedirectUri(options.uri, uri);
+ final redirectOptions = options.copyWith(
+ path: redirectUri.toString(),
+ maxRedirects: --options.maxRedirects,
+ );
+ if (!_sameOrigin(options.uri, redirectUri)) {
+ redirectOptions.headers.removeWhere(
+ (name, _) => _sensitiveRedirectHeaders.contains(name.toLowerCase()),
+ );
+ }
return _fetch(
- options.copyWith(path: path, maxRedirects: --options.maxRedirects),
+ redirectOptions,
list != null ? Stream.fromIterable(list) : null,
cancelFuture,
redirects,
);
+
+ static bool _sameOrigin(Uri a, Uri b) =>
+ a.scheme == b.scheme && a.host == b.host && a.port == b.port;
```
### PoC
The following steps reproduce the vulnerability using two local HTTP/2 cleartext (h2c) servers inside an isolated Docker container (no external network required).
**Prerequisites:**
- Docker installed and accessible.
- Repository checked out at the path used as the build context.
**Build and run:**
```bash
# From the repository root (github_web_81_cfug__dio/)
docker build -f vuln-001/Dockerfile -t dio-vuln-001:poc .
docker run --rm --network none dio-vuln-001:poc
```
**What the container does:**
1. Starts an *origin* h2c server on `127.0.0.1:18081` that immediately returns `302 Location: http://127.0.0.1:18082/capture`.
2. Starts an *attacker* h2c server on `127.0.0.1:18082` that logs every received header.
3. Executes the following Dart exploit:
```dart
final dio = Dio()
..httpClientAdapter = Http2Adapter(ConnectionManager());
await dio.get(
'http://127.0.0.1:18081/start',
options: Options(headers: {
'Authorization': 'Bearer SECRET
A vulnerability in OWASP Coraza WAF versions 3.0.0 through 3.7.x allows attackers to bypass WAF rules due to an encoding error in the t:jsDecode transformation. This flaw causes JavaScript octal escape sequences to be improperly decoded, resulting in null byte output that corrupts rule inspection. The issue is fixed in version 3.8.0.
VeraCrypt 1.26.29 (FUSE-T build) on macOS has an incomplete cleanup vulnerability where the FUSE-T auxiliary service and related helper processes are not terminated after volume dismount. This causes the decrypted volume image to remain accessible via a loopback SMB session, allowing local users or processes to remount and access decrypted data without the passphrase. The macFUSE build is not affected.