EUVD-2026-80301

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...

CVE-2026-89780

CVE-2026-89780 is a null-pointer dereference in the Linux kernel's Qualcomm RMNET driver (drivers/net/ethernet/qualcomm/rmnet). The function rmnet_map_deaggregate() allocates sub-frames via alloc_skb() leaving skb->dev as NULL. Because MAP command frames are dispatched to rmnet_map_command() b...

[SECURITY] [DSA 6496-2] nginx regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-6496-2 [email protected] https://www.debian.org/security/ Aron Xu September 16, 2026 https://www.debian.org/security/faq -...

PT-2026-93661

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the gadget dev ioctl function. The issue occurs because the function reads dev-gadget before acquiring dev-lock, while the dev-state is checked only...

PT-2026-93464

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between a partial drm dev register failure and an ioctl operation. If drm dev register fails after a minor has been registered, userspace may open that minor and...

PT-2026-93585

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the ASOC hdac hda component. The hdac hda dev probe function acquires an HDA link using snd hdac ext bus link get before registering the ASoC component. ...

CVE-2026-89951: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

PT-2026-93518

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the saa7164 dev setup function where a device is added to the global saa7164 devlist before PCI BAR memory regions are requested. If the get resources function fails,...

CVE-2026-56923

In handleunmapreq of tipcvirtiodev.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57148

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORMJWTSECRET is unset, while the startup and token-issuance guards are disabled because PLATFORMENV also defaults to dev. An...

EUVD-2026-78396

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORMJWTSECRET is unset, while the startup and token-issuance guards are disabled because PLATFORMENV also defaults to dev. An...

CVE-2026-57148 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORMJWTSECRET is unset, while the startup and token-issuance guards are disabled because PLATFORMENV also defaults to dev. An...

CVE-2026-57148 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORMJWTSECRET is unset, while the startup and token-issuance guards are disabled because PLATFORMENV also defaults to dev. An...

CVE-2026-57148

PraisonAI 's Python package praisonai-platform (versions ≤ 0.1.4, including the version GHSA-3qg8 incorrectly declared patched) ships a hardcoded JWT signing key ("dev-secret-change-me", HS256) in auth_service.py that is used whenever PLATFORM_JWT_SECRET is unset. The intended production guard is...

PT-2026-92367

In smmu detach dev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PT-2026-92358

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Improper input validation in the smmu detach dev nested function within arm-smmu-v3.c may allow a local escalation of privilege. Exploitation requires System execution privileges and doe...

dev-tools-eagle (>=0.9.0, <=0.9.4) potentially affected by CVE-2026-55253 via langgraph-store-mongodb (0.1.1)

langgraph-store-mongodb PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-store-mongodb and may be impacted: - dev-tools-eagle =0.9.0, =0.9.4 Source cves: CVE-2026-55253 Source advisory: MEND:CVE-2026-55253...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: atm: clip: Fixed NULL pointer dereferencing in vccsendmsg atmarpddevops does not implement the send method, which may cause crashes as described below. BUG: NULL pointer dereferencing in the kernel, address: 0000000000000000 P...

Astra Linux – Vulnerability in Firefox and Thunderbird

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks were executed for those events. Web content that attempted to use those interfaces would not be able to do so with elevated privileges. However, the presence of these interfaces indicated...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: hwrng: amd – Fixed the PCI device reference count leak. foreachpcidev is implemented through pcigetdevice. The comment for pcigetdevice states that it will increase the reference count of the returned pcidev, and also decrease...