Vulnerability intelligence

CVE-2026-72137 describes a double-free error found within the Linux kernel's NAT keep-alive implementation. This vulnerability occurs when the `nat_keepalive_send()` function attempts to free a socket buffer (skb) twice. This happens if a send helper reports an error after the packet has already been passed to the output path, where the networking stack might have already consumed and freed the skb. This flaw can lead to undefined memory handling, potentially resulting in memory corruption, a kernel crash, or other unpredictable system behavior. All Linux kernel releases that incorporate the `nat_keepalive_send` path, including both IPv4 and IPv6 stacks, are potentially affected by this issue.

CVE-2023-49105 is an authentication bypass vulnerability found in ownCloud Server, specifically within its WebDAV API implementation. This flaw arises from the improper validation of pre-signed URLs when the targeted user does not have a signing-key configured. An attacker can exploit this vulnerability by knowing a victim's username, allowing them to access, modify, or delete any of that user's files without needing to authenticate. This issue affects ownCloud Server versions 10.6.0 through 10.13.0.

CVE-2026-53362 describes a vulnerability within the Linux kernel's IPv6 networking subsystem, specifically concerning the `__ip6_append_data()` function. The flaw arises from incorrect accounting for "fraggap" (fragment gaps) when data is handled via the paged allocation path. This miscalculation occurs when `alloclen` and `pagedlen` are computed, particularly when `fraggap` is non-zero, leading to an undersized linear area and an overstated `pagedlen`. This accounting error can result in memory corruption, as bytes carried over from a previous `skb` (socket buffer) are copied past the intended boundary into the `skb_shared_info` structure. An unprivileged user can trigger this out-of-bounds write by utilizing a UDPv6 socket in conjunction with the `MSG_MORE` and `MSG_SPLICE_PAGES` flags. The issue was introduced by a commit aimed at avoiding partial copies for zero-copy operations, and a later commit allowed `MSG_SPLICE_PAGES` to proceed in this vulnerable state, making the corruption exploitable.

CVE-2026-66384 is identified as a path traversal vulnerability (CWE-22) affecting JFrog Artifactory. This flaw allows an authenticated user to write data outside of the designated Docker cache path. This can occur when specific remote-repository conditions are met within the Artifactory environment. The vulnerability stems from how JFrog Artifactory handles path construction for cached Docker artifacts retrieved through remote repositories. Under certain configurations, the input used to determine the cache path is not adequately normalized against traversal sequences, enabling an authenticated user with appropriate permissions to manipulate the write path. This results in files being written to arbitrary locations accessible by the Artifactory process, thereby undermining the integrity of files on the Artifactory server.

CVE-2026-53362 describes a vulnerability within the Linux kernel's IPv6 networking subsystem, specifically concerning the `__ip6_append_data()` function. The flaw arises from incorrect accounting for "fraggap" (fragment gaps) when data is handled via the paged allocation path. This miscalculation occurs when `alloclen` and `pagedlen` are computed, particularly when `fraggap` is non-zero, leading to an undersized linear area and an overstated `pagedlen`. This accounting error can result in memory corruption, as bytes carried over from a previous `skb` (socket buffer) are copied past the intended boundary into the `skb_shared_info` structure. An unprivileged user can trigger this out-of-bounds write by utilizing a UDPv6 socket in conjunction with the `MSG_MORE` and `MSG_SPLICE_PAGES` flags. The issue was introduced by a commit aimed at avoiding partial copies for zero-copy operations, and a later commit allowed `MSG_SPLICE_PAGES` to proceed in this vulnerable state, making the corruption exploitable.

CVE-2023-49105 is an authentication bypass vulnerability found in ownCloud Server, specifically within its WebDAV API implementation. This flaw arises from the improper validation of pre-signed URLs when the targeted user does not have a signing-key configured. An attacker can exploit this vulnerability by knowing a victim's username, allowing them to access, modify, or delete any of that user's files without needing to authenticate. This issue affects ownCloud Server versions 10.6.0 through 10.13.0.