Search: rx.the

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by_id ovpn_nl_peer_set_doit() resolves the target peer via ovpn_peer_get_by_id() before taking ovpn->lock. In the window between the lookup (which only takes a refcount) and the subsequent spin_lock_bh(&ovpn->lock), a concurrent OVPN_CMD_PEER_DEL, keepalive expiry, or socket teardown can take ovpn->lock first, run ovpn_peer_remove() to unhash the peer from all four tables (by_id, by_vpn_addr4/6, by_transp_addr) and release the lock. set_doit then acquires ovpn->lock and calls ovpn_peer_hash_vpn_ip(), which re-inserts the now-removed peer back into the rehashing tables. The same race affects the float path: ovpn_peer_endpoints_update() holds only a refcount and acquires ovpn->lock very late (after async AEAD decrypt and a netlink notification), then rehashes the peer in the by_transp_addr table. The resurrected peer becomes reachable again from the RX lookup (ovpn_peer_get_by_transp_addr) and the TX VPN-IP lookup, even though userspace believes it is gone. Once the data-path refcount drops the peer is freed via call_rcu while the hash entries embedded in it remain linked, opening a UAF window. Bail out of the rehash when hash_entry_id is unhashed, mirroring the sentinel already used by ovpn_peer_remove() to detect the already-removed state. The check is safe under ovpn->lock, which serializes every mutation of hash_entry_id, and is a no-op for the add path because ovpn_peer_add_mp() inserts hash_entry_id before calling ovpn_peer_hash_vpn_ip().

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps. Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset(): WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864 Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.

A vulnerability in the Linux kernel's serial driver for the NXP LPC32xx UART causes an interrupt storm leading to CPU livelock on single-core ARM926 systems. The issue arises because the RX character-timeout interrupt can be latched while the RX FIFO is empty, and the condition is not cleared properly, causing the interrupt to re-fire continuously.

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD. Revert the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy. Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length.

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.

CVE-2026-13176 is a Server-Side Request Forgery (SSRF) vulnerability in the Eventin WordPress plugin versions before 4.1.21. It allows users with contributor-level access or higher to trigger blind server-side requests to arbitrary hosts by exploiting insufficient validation of user-supplied webhook URLs and lack of event ownership verification.

CVE-2026-77085 is a Server-Side Request Forgery (SSRF) vulnerability in n8n versions before 2.34.1 and 2.33.x before 2.33.4. The issue arises from the SearXNG Agent tool sending requests to user-supplied API URLs using a raw HTTP client that bypasses n8n's centralized SSRF protection. An authenticated user with permission to create SearXNG credentials and configure a personal agent can exploit this to make the n8n server connect to internal hosts and return their response content.

CVE-2026-73998 is a high-severity SQL Injection vulnerability affecting WP w3all phpBB versions up to 3.0.5. It involves improper neutralization of special elements in SQL commands, allowing an attacker with low privileges to execute crafted SQL queries. The vulnerability impacts confidentiality and availability but does not affect integrity. No patch or remediation details are provided in the available data.

A vulnerability in FreeIPA allows a low-privilege authenticated user to exploit the system by submitting an oversized One-Time Password (OTP). This flaw can cause a denial of service condition. The issue affects multiple specific versions of FreeIPA. The CVSS score is 6.5, indicating a medium severity impact primarily affecting availability.

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.

Punk::OAuth2 versions before 0.03 for Perl contain an open redirect vulnerability due to improper validation of the return parameter after login. The same_origin_path function incorrectly allows backslash and tab characters, which can be interpreted as slashes in URLs, enabling attackers to redirect users to malicious sites after authentication. This redirect occurs without exposing authorization codes or access tokens.

A command injection vulnerability exists in chenhg5 cc-connect up to version 1.4.1 in the Management API component. The flaw is in the shellExecCommand function of core/engine.go, where manipulation of the exec argument allows remote OS command injection. The vulnerability has a CVSS score of 7.3 (medium severity). Public exploit code is available, but there are no known exploits in the wild. The reported GitHub issue was closed due to inactivity, and no patch or remediation information is provided.

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language (SPL) pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all relevant data, affect system integrity, and affect availability of the Splunk platform instance. The SPL injection is possible because Deployment Server client identifiers are placed into dispatched searches without neutralizing special characters. Successful exploitation requires an administrator to open the affected Add Data forwarder workflow after the unauthenticated user registers a crafted Deployment Server client identity. For more information see Forward data (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.2/how-to-get-data-into-your-splunk-deployment/forward-data) and About agent management (https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/10.4/agent-management/about-agent-management) in the Splunk documentation.

CVE-2026-76926 is a reachable assertion vulnerability in the BUSMASTER file parser component of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This vulnerability can cause Wireshark to exit abnormally, resulting in a denial of service condition. The issue has a low severity rating with a CVSS score of 3.1. No known exploits are reported in the wild, and no official patch or remediation information is currently available.

CVE-2026-76400 is a medium severity vulnerability in Splunk Connect for Kafka versions 2.2 and from 2.2 up to but not including 2.2.7. It allows an unauthenticated user who can access the Kafka Connect REST API and influence HTTP Event Collector responses to cause the connector to retry failed event batches indefinitely. This unbounded retry behavior can exhaust system resources, leading to denial of service conditions.

CVE-2026-76372 affects the Splunk Nmap Scanner connector in versions 3.0 up to but not including 3.0.15. The vulnerability arises because the scan network action is incorrectly marked as read-only, despite accepting script parameters that can perform write operations. This misclassification allows users with roles that can edit, create, or run playbooks in Splunk SOAR to execute commands or make changes on target systems via Nmap Scripting Engine scripts when running the scan network action in Safe Mode playbooks.

GitPython versions before 3.1.58 contain a path traversal vulnerability due to improper validation of submodule names in .gitmodules files. This flaw allows attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory by using traversal sequences in submodule names. The vulnerability is rated high severity with a CVSS score of 8.4.

This update for python313 fixes the following issues: - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044). - CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041). - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959). - CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268). - CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977). - CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788). - CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

CVE-2026-58087 is a local privilege escalation vulnerability in the semctl(2) system call's GETALL and SETALL commands. These commands improperly handle semaphore sets by relying on a sequence number that can wrap after extensive create/destroy cycles. An unprivileged local user can exploit this to cause out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation.

The wg(4) driver in FreeBSD fails to verify the success of the MAC (Poly1305) authentication step after decrypting packets. This flaw allows remote attackers who can send UDP packets to a WireGuard endpoint and guess the replay window bounds to inject forged or modified transport data packets into the tunnel. Additionally, attackers intercepting WireGuard packets can modify ciphertext and authenticated data without detection.