CVE-2026-73669 Signify Philips Hue Bridge Pro MQTT broker missing authentication

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in...

Philips Hue Bridge Pro

RISK EVALUATION The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker v2.0.22 that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights...

CVE-2026-73669: Missing Authentication for Critical Function

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in...

PT-2026-71799

Name of the Vulnerable Software and Affected Versions Signify Philips Hue Bridge Pro versions prior to 1.77.2071318010 Description The firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces with anonymous access enabled and no firewall restrictions. This allows an...

CVE-2026-68280

A flaw was found in the Linux kernel's drm/bridge: cdns-dsi component. This vulnerability arises from the incorrect use of a deprecated power management function, causing the system to attempt to disable DSI Display Serial Interface clocks twice during suspend operations. This redundant action...

CVE-2026-68084

A flaw was found in the Linux kernel's tsi148 bridge component. This vulnerability occurs due to a resource leak where the location monitor resources are not properly freed during device unbind or module unload operations. An attacker could potentially exploit this flaw to exhaust system resource...

drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()

...

CVE-2026-68280

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

CVE-2026-68084

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

CVE-2026-68084

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

UBUNTU-CVE-2026-68084

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

CVE-2026-68280

The CVE affects the Linux kernel DRM/Bridge code for cdns-dsi. The root cause is using the deprecated UNIVERSAL_DEV_PM_OPS() macro, which handles both runtime PM and system sleep, causing DSI clocks to be disabled twice (runtime suspend and system suspend). This can trigger a WARN from the clock ...

EUVD-2026-55381

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

CVE-2026-68280 drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

EUVD-2026-55265

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

CVE-2026-68084 staging: vme_user: fix location monitor leak in tsi148 bridge

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

CVE-2026-68084

The CVE concerns the Linux kernel staging: vme_user component, specifically the tsi148 bridge. The root cause is a leaked location monitor resource (lm_resources) because tsi148_remove() did not free lm_resources when unbinding or unloading, unlike other resources. The fix is to free the lm_resou...

CVE-2026-68084 staging: vme_user: fix location monitor leak in tsi148 bridge

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

CVE-2026-68280: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

PT-2026-69680

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cdns-dsi bridge where the use of the deprecated UNIVERSAL DEV PM OPS macro causes DSI clocks to be disabled twice: once during runtime suspend and again during...