Month: February 2026
CVE-2023-46218 This flaw allows a malicious HTTP server to set “super cookies” in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl’s function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk` even though `co.uk` is listed as a PSL domain.
It could do this by exploiting a mixed case flaw in curl’s function that
verifies a given cookie domain against the Public Suffix List (PSL). For
example a cookie could be set with `domain=co.UK` when the URL used a lower
case hostname `curl.co.uk` even though `co.uk` is listed as a PSL domain.
CVE-2025-21749 net: rose: lock the socket in rose_bind()
Information published. Continue reading CVE-2025-21749 net: rose: lock the socket in rose_bind()
CVE-2025-38091 drm/amd/display: check stream id dml21 wrapper to get plane_id
CVE-2025-39788 scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
Information published. Continue reading CVE-2025-39788 scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
CVE-2022-1292 The c_rehash script allows command injection
Information published. Continue reading CVE-2022-1292 The c_rehash script allows command injection
CVE-2024-43892 memcg: protect concurrent access to mem_cgroup_idr
Information published. Continue reading CVE-2024-43892 memcg: protect concurrent access to mem_cgroup_idr