CVE-2026-98349 is a vulnerability in the Linux kernel's wifi libipw driver where too-short beacon and probe response frames are not properly rejected. This leads to an integer wraparound in length calculation, causing the parser to read beyond the allocated buffer. The flaw was found through AI-assisted code review and has been fixed in several Linux kernel commits.
A vulnerability in the Linux kernel's wifi cfg80211 subsystem involved improper grouping of hidden BSS entries without beacon elements. This could cause internal warnings due to unexpected grouping behavior when probe responses and beacons are processed. The issue has been resolved by ensuring only entries with beacon information are grouped, preventing the problematic state.
A vulnerability in the Linux kernel ALSA virtio driver was fixed by ensuring the device is reset before deleting virtqueues. Previously, virtqueues were deleted before resetting the device, which could allow the device to access freed vring memory. The fix involves resetting the device first to prevent access to released memory, covering normal operation and probe failure cases.
A vulnerability in the Linux kernel's mmc: sdhci-of-aspeed driver was fixed by ensuring that child devices are properly unregistered before releasing parent clock and resources. The issue involved probe failure and removal leaving SDHCI child devices registered after their parent resources were released, which could cause system instability or resource management issues.
A vulnerability in the Linux kernel's mwifiex driver allows an out-of-bounds read due to improper bounds checking of the pairwise-cipher OUI count in RSN or WPA information elements. An attacker can craft a beacon or probe response with a large pairwise count, causing the driver to read beyond the allocated buffer during scan-result parsing. This issue has been fixed by bounding the OUI walk to the actual IE length and validating the length to prevent underflow.
A vulnerability in the Linux kernel's AMDGPU driver involves improper handling of KFD device initialization. Specifically, the function amdgpu_amdkfd_clear_kfd_mapping() assumes a fully populated node array, which may not be true if KFD device initialization fails after probe. This can lead to dereferencing a null pointer during GPU reset on certain systems. The issue has been fixed by requiring an authoritative KFD initialization flag before accessing the node array.
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without a closing greater-than character. The synchronous parser converts and scans the full supplied buffer without an input cap, while the streaming parser reparses the complete accumulated SVG prefix for every received chunk. The probe.sync(), probe(stream), and probe(url) entry points can therefore block the Node.js event loop at full CPU, and attacker-controlled chunking can amplify the streaming cost. This issue is fixed in version 7.4.0.
YesWiki versions prior to 4.6.7 contain a server-side request forgery (SSRF) vulnerability in the WebfingerService. This flaw allows unauthenticated attackers to send crafted HTTPS requests to internal hosts by posting a specially crafted actor_handle with numeric host and port values to the abonnements view. The vulnerability can be used to probe internal HTTPS services and ports.
YesWiki versions prior to 4.6.7 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to make the server fetch arbitrary hosts and ports by exploiting the url parameter in the {{valeur}} action. Attackers can submit this action through the content parameter of handlers/page/render.php to probe internal HTTP services and read response content that matches fiche markup. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity.
YesWiki versions before 4.6.7 have a blind server-side request forgery (SSRF) vulnerability in the /api/entries/bazarlist endpoint. This flaw allows unauthenticated attackers to make arbitrary server-side requests by exploiting the idtypeannonce parameter. The vulnerability arises because the isValidURL() function always returns true, enabling attackers to supply internal URLs that the server fetches using curl in loadURLContent(). This can be used to probe internal networks and access internal services or metadata endpoints.
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL's path or query can satisfy image.domains or image.remotePatterns while the URL's actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4.
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries.
The npm package simple-date-formatter-new-12@1.0.0 contains malicious code in its postinstall script that executes automatically during installation. This script fetches data from an internal Baidu host and exfiltrates the response to an attacker-controlled server. The package's stated functionality is a simple date formatter, but the embedded network activity is unrelated and indicative of a dependency confusion or typosquatting attack to probe internal network access and leak data.
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. Attackers can deliver command execution or Agent configuration tasks to Agents within their authorization scope by exploiting the shared protobuf Task.Type namespace between service monitors and privileged operations.
January, the media proxy/embed service of stoatchat, before version 0.15.5, improperly resolves SVG <image href> values as local filesystem paths when serving image/svg+xml content. This allows an unauthenticated remote attacker to probe for local file existence via timing differences and disclose local image files after re-encoding. The vulnerability can also cause unbounded local filesystem I/O and memory pressure, leading to denial of service. The issue is fixed in version 0.15.5.
A vulnerability in the Linux kernel's ath9k_htc WiFi driver was resolved. The issue involved storing the usb_device_id, which is not guaranteed to persist beyond the probe phase due to dynamic IDs. The fix involves storing only driver_data, which is reliably retrievable from the usb_device structure.