CVE-2026-89754 mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walkpmdrange If -pmdentry sets walk-action = ACTIONAGAIN, the pmdnone check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-installpte is not...

CVE-2026-89476 sctp: fix stream->outcnt underflow on duplicate RECONF responses

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89476 sctp: fix stream->outcnt underflow on duplicate RECONF responses

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

EUVD-2026-76382

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89476

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-68526 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

CVE-2026-68526

Concrete CMS before 9.5.3 is affected by a missing anti-CSRF token validation in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php), specifically in its submit() action. The action only checked canAccess() and the per-resource canAddCalendarEvent() pe...

PT-2026-90255

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDS VALUE options gssx dec option array walks the wire-supplied option array and, for every entry whose name matches CREDS VALUE, calls gssx dec linux creds on the same struct svc cred. That helper...

PT-2026-90192

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADD OUT request again while another...

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

ImpactThe only authorization gate on the duplicate flow is PageAdmin.hasaddpermission,which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “maythis user create a page at all”. Nothing checks the user’s relationship to the page beingcopied:- cms/admin/forms.py —...

PYSEC-2026-3821 django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

CVE-2026-86744

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86198

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86744

Snipe-IT (8.6.3 and earlier) is affected by a race condition in its asset checkout paths. The methods Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() outside the mutation path and then invoke Asset::checkOut() without a row lock or r...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2026-86198

PocketMine-MP versions before 5.44.2 are vulnerable to a denial-of-service condition in the resource pack handling subsystem. The root cause is a failure to properly validate multiple ResourcePackClientResponsePacket packets carrying the STATUS_COMPLETED status, which allows malicious clients to ...