CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

PT-2026-94308

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.0 through 3.11.6 Description Absolute host filesystem paths are leaked to sandboxed code via error stack formatting. An attacker can force the host-realm source transformer to throw a SyntaxError by calling eval with malforme...

unbound security update

1.24.2-20 - Backport additional fix of locks during initialization 1.24.2-19 - Fix CVE-2026-50252: prevent cache poisoning via shared ports 1.24.2-18 - Add unit tests for CVE-2026-44690,55973 1.24.2-17 - Fix CVE-2026-55973: dns-error-reporting stack buffer overflow 1.24.2-16 - Fix CVE-2026-44690 ...

EulerOS 2.0 SP15 : libsoup (EulerOS-SA-2026-3810)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked functio...

CVE-2026-90279: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5bitmapsectormap aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data...

CVE-2026-93109: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

PT-2026-94253

Name of the Vulnerable Software and Affected Versions sachertortephp affected versions not specified Description A logic error exists in the Xml::build static method within the lib/Cake/Utility/Xml.php file. The issue stems from incorrect operator precedence in a conditional statement intended to...

CVE-2026-90262: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

CVE-2026-90154: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...

CVE-2026-90271: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...

CVE-2026-93187: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Return error for invalid number of formats When the number of input or output formats is zero, sofipc4widgetsetupcompsrc and sofipc4widgetsetupcompasrc print an error and jump to the cleanup label. At th...

CVE-2026-90403: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path in rtlpciprobe, the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtlinitrfkill, ieee80211registerhw,...

PT-2026-94568

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA sequencer where the bounce error event function leaks a kernel memory address to userspace. When a queued variable-length event fails, the data.ext.ptr variab...

PT-2026-94712

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the acpi processor driver init function where the cpufreq policy notifier is registered before the ACPI processor driver and CPU hotplug state are established. If driv...

CVE-2026-93155: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Fix AEAD unregister count in error path registeraesalgs registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registratio...

CVE-2026-93157: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hwrng: xilinx-trng - propagate timeout before any data is read xtrngreadblock32 polls for 16-byte chunks but returns the number of bytes read even when the first poll times out. Its caller then treats a zero return as a short...

CVE-2026-93142: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code accidentally calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call until later to avoid an error pointer...

PT-2026-94928

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ACPI subsystem for RISC-V architectures within the riscv acpi add prt dep function. The loop handling within this function incorrectly manages error conditions by...

PT-2026-94727

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7921 Wi-Fi driver where a PCIe Advanced Error Reporting AER error can cause the bus to hang. When this occurs, register reads return 0xFFFFFFFF, which corrupts t...