undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression

A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service DoS by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in t...

CVE-2026-89178 Howyar｜WeenyGenius - Origin Validation Error

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the...

BIT-TOMCAT-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23,...

CVE-2026-89145

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

EUVD-2026-75896

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

PT-2026-90170

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the PCI plda component where the plda init interrupts function fails to unwind IRQ domains and IRQ mappings when a subsequent step in the initialization process fails...

PT-2026-96497

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...

PT-2026-90420

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd copy file range function where the dst-f wb err value is sampled into the since variable after the copy loop. Because the nfsd file cache reuses a single file...

PT-2026-90293

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm-io interface where non-retryable error codes BLK STS NOTSUPP and BLK STS INVAL could incorrectly cause leg failure on dm-raid1. This leads to misbehavior when...

ROS-20260911-73-0194

The vulnerability in Chromium is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-89502: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpubuffer::freepage with subbuforder When sub-buffers use an order greater than 0, cpubuffer-freepage is allocated with subbuforder. Use the correct order for cpubuffer-freepage...

PT-2026-90178

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Functions max17040 get vcell and max17040 get soc fail to handle errors returned by regmap read. If an I2C transfer fails, an uninitialized register value is processed and reported to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107292)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107292 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayedwork on cachectr error An unexpected WARNON from...

ROS-20260911-73-0138

The vulnerability in Chromium is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause service failures...

PT-2026-90215

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ring-buffer page swap mechanism where the swap reader page callback may return -EBUSY if the writer moves the head before the remote reader catches it, which is...

CVE-2026-89178: Improper Verification of Source of a Communication Channel

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the...

CVE-2026-89145: Improper Neutralization of Input During Web Page Generation

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-78807: Origin Validation Error

An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107317)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107317 advisory. In the Linux kernel, the following vulnerability has been resolved: iavf: Fix adminq error handling iavfallocasqbufs/iavfallocarqbufs allocates with dmaalloccoherent...

PT-2026-96509

In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable folio handling sort folio has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follo...