CVE-2026-28336: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of…

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required...

CVE-2026-99253: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: rearm local work wake up before…

In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: rearm local work wake up before sleep iouringtrycancelrequests sets -cqwaitnr to 1 so that the next ioreqlocalworkadd wakes the cancelling task. The add that takes the count to zero is the only one that wakes, lat...

CVE-2026-121414: parse-community parse-server: Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object…

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writab...

CVE-2026-99260: Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in…

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfsnewattrflags When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated...

CVE-2026-99266: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix buffer offsets in areas above…

In the Linux kernel, the following vulnerability has been resolved: iouring/zcrx: fix buffer offsets in areas above 4GB iozcrxqueuecqe computes the offset of the buffer in its area from netiovidx, which is an unsigned int, so the shift is done in 32 bits and only the result is widened to the u64...

CVE-2026-121431: AzuraCast: AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks…

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instanceurl, api, or webhookurl to internal addresses a...

CVE-2026-119675: MongoDB Database Tools: MongoDB Database Tools mongorestore inconsistently handles the system.buckets

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized...

CVE-2026-99267: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/napi: make stale entries time out after…

In the Linux kernel, the following vulnerability has been resolved: iouring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined a...

CVE-2026-121261: phpMyAdmin ShapeFile: A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1

A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Th...

CVE-2026-99248: Linux: In the Linux kernel, the following vulnerability has been resolved: i2c: xiic: restore non-managed runtime PM to fix…

In the Linux kernel, the following vulnerability has been resolved: i2c: xiic: restore non-managed runtime PM to fix clk WARN flood The devres conversion replaced manual pmruntimeenable/disable with devmpmruntimesetactiveenabled and dropped the remove-time runtime PM teardown. The managed release...

CVE-2026-121419: surrealdb: SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject…

SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's...

CVE-2026-99244: Linux: In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from…

In the Linux kernel, the following vulnerability has been resolved: pidnamespace: prevent TIFNOTIFYSIGNAL from interrupting the reaper Since commit 7fea700e04bd "zappidnsprocesses: clear TIFNOTIFYSIGNAL along with TIFSIGPENDING" zappidnsprocesses clears TIFNOTIFYSIGNAL before every kernelwait4...

CVE-2026-99262: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/timeout: don't lose a cancel as io-wq arms…

In the Linux kernel, the following vulnerability has been resolved: iouring/timeout: don't lose a cancel as io-wq arms a timeout An IORINGOPTIMEOUT run by io-wq, because of IOSQEASYNC, has the same problem as poll, futex and waitid. iowqsubmitwork looks at IOWQWORKCANCEL once, before it issues th...

CVE-2026-121386: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and…

FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winprreadpngfrombuffer and winprconvertfromjpeg, which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit...

CVE-2026-108051: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-99264: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't retry recv on uncommitted…

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b "iouring/net: commit partial buffers on retry" commits ring provided buffers when a receive is going to be retried after a partial transfer, so that another...

CVE-2026-121259: Red Hat: A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad

A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service...

CVE-2026-121424: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote…

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address,...

CVE-2026-99269: Linux: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before…

In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue and hasn't cleared SCXOPSSDISPATCHING. The DSQ consume and...

CVE-2026-121434: froxlor: Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API…

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...