In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. This driver takes a reference to the USB device during probe but does not to release it on all probe errors (e.g. when descriptor parsing fails). Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.
A vulnerability in the Linux kernel's rt2x00usb WiFi driver was fixed to address improper management of device resource lifetimes tied to USB interfaces. The flaw could cause memory leaks when drivers are unbound without physical device disconnection, such as during probe deferral or configuration changes. The fix ensures that USB device resources are released appropriately on driver unbind, preventing resource leaks.
Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller.
Starting March 10, 2026, my DShield sensor started getting probe for various AI models such as claude, openclaw, huggingface, etc. Reviewing the data already reported by other DShield sensors to ISC, the DShield database shows reporting of these probes started that day and has been active ever since.
Chamilo LMS versions prior to 2.0.0-RC.3 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the PENS plugin endpoint. This endpoint accepts a user-controlled URL parameter that the server fetches without filtering internal or private IP addresses. Exploitation allows attackers to probe internal network services, access cloud metadata endpoints to steal credentials, or trigger state-changing operations on internal services without authentication. The issue has been fixed in version 2.0.0-RC.3.
jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2.
CVE-2026-31426 is a use-after-free vulnerability in the Linux kernel's ACPI EC driver. It occurs when probe failure handling in acpi_ec_setup() does not properly clean up installed handlers, leading to a dangling pointer. This can cause kernel memory corruption when AML code accesses EC OpRegion fields, potentially resulting in system crashes or privilege escalation.
An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, he superbooga and superboogav2 RAG extensions fetch user-supplied URLs via requests.get() with zero validation — no scheme check, no IP filtering, no hostname allowlist. An attacker can access cloud metadata endpoints, steal IAM credentials, and probe internal services. The fetched content is exfiltrated through the RAG pipeline. This vulnerability is fixed in 4.3.
prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service without receiving direct response bodies.
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Fix memory leak in aml_spisg_probe() In aml_spisg_probe(), ctlr is allocated by spi_alloc_target()/spi_alloc_host(), but fails to call spi_controller_put() in several error paths. This leads to a memory leak whenever the driver fails to probe after the initial allocation. Convert to use devm_spi_alloc_host()/devm_spi_alloc_target() to fix the memory leak.
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Fix an unlikely NULL pointer deference at probe intel_dmc_update_dc6_allowed_count() oopses when DMC hasn't been initialized, and dmc is thus NULL. That would be the case when the call path is intel_power_domains_init_hw() -> {skl,bxt,icl}_display_core_init() -> gen9_set_dc_state() -> intel_dmc_update_dc6_allowed_count(), as intel_power_domains_init_hw() is called *before* intel_dmc_init(). However, gen9_set_dc_state() calls intel_dmc_update_dc6_allowed_count() conditionally, depending on the current and target DC states. At probe, the target is disabled, but if DC6 is enabled, the function is called, and an oops follows. Apparently it's quite unlikely that DC6 is enabled at probe, as we haven't seen this failure mode before. It is also strange to have DC6 enabled at boot, since that would require the DMC firmware (loaded by BIOS); the BIOS loading the DMC firmware and the driver stopping / reprogramming the firmware is a poorly specified sequence and as such unlikely an intentional BIOS behaviour. It's more likely that BIOS is leaving an unintentionally enabled DC6 HW state behind (without actually loading the required DMC firmware for this). The tracking of the DC6 allowed counter only works if starting / stopping the counter depends on the _SW_ DC6 state vs. the current _HW_ DC6 state (since stopping the counter requires the DC5 counter captured when the counter was started). Thus, using the HW DC6 state is incorrect and it also leads to the above oops. Fix both issues by using the SW DC6 state for the tracking. This is v2 of the fix originally sent by Jani, updated based on the first Link: discussion below. (cherry picked from commit 2344b93af8eb5da5d496b4e0529d35f0f559eaf0)
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability. This issue has been patched in version 6.9.4.
A deadlock vulnerability in the Linux kernel's PHY LED trigger registration was resolved. The issue occurs when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled, causing an AB-BA deadlock due to conflicting lock acquisition orders involving triggers_list_lock and rtnl_mutex. The vulnerability affects specific Linux kernel versions and has been fixed by changing the registration timing of PHY LED triggers to avoid holding conflicting locks simultaneously.
CVE-2026-33329 is a high-severity path traversal vulnerability in FileRise, a self-hosted web file manager and WebDAV server. Versions from 1.0.1 up to but not including 3.10.0 are affected. The issue arises because the resumableIdentifier parameter in the chunked upload handler is concatenated directly into filesystem paths without sanitization. An authenticated user with upload permissions can exploit this flaw to write files to arbitrary directories, delete directories during cleanup, and probe for file or directory existence. No user interaction beyond authentication is required, and the vulnerability allows significant integrity and availability impact. The vulnerability has been patched in version 3.
The FBI has issued an alert regarding malware linked to Iranian government hackers, discovered during an investigation involving the company Stryker. This malware represents a targeted cyber threat attributed to state-sponsored actors from Iran. While specific technical details and affected software versions are not disclosed, the medium severity rating suggests moderate risk to confidentiality, integrity, or availability. No known exploits are currently active in the wild, and no specific indicators of compromise have been publicly shared. The threat highlights ongoing geopolitical cyber tensions and the use of malware for espionage or disruption. Organizations in sectors with strategic importance or those operating in regions targeted by Iranian cyber operations should remain vigilant. Mitigation involves enhanced monitoring for suspicious files, network traffic analysis, and applying threat intelligence updates from trusted sources. Countries with significant exposure include the United States, Israel, Saudi Arabia, United Arab Emirates, and other Western and Middle Eastern nations. Given the medium severity, the threat requires proactive defense but is not currently critical. Defenders should focus on early detection and incident response readiness to mitigate potential impacts.
This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques.
Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.
The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue can be exploited to make the server send requests to probe the internal network, remotely download malicious files, and perform other dangerous operations.
