PT-2026-69610

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the stm32 dcmi media component where the dcmi graph init function registers an async notifier before the dcmi probe function toggles the reset line. If the reset contr...

PT-2026-69593

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the RX worker of the Linux kernel when handling PKT TYPE TXRX NOTIFY events on non-mmio buses, such as USB. The functions mt7925 rx check and mt7925...

PT-2026-69626

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference can occur in the cx23885 dev setup function due to a missing check for the return value of the pci ioremap bar function. If the memory mapping for BAR0 fails,...

Linux Distros Unpatched Vulnerability : CVE-2026-68203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized...

Linux Distros Unpatched Vulnerability : CVE-2026-68403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. I...

Linux Distros Unpatched Vulnerability : CVE-2026-68181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist acce...

PT-2026-69485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the vme user staging driver within the tsi148 bridge. The tsi148 probe function allocates a location monitor resource and adds it to the lm resources list of the...

JLSEC-2026-1214 The curl logic that works with SASL authentication could end up cleaning up the GSASL context ...

The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free the same pointer twice...

JLSEC-2026-1197 A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream...

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes curleasyreset, and finally terminates the handle with curleasycleanup. During this final cleanup phase, libcurl...

crypto: amlogic - avoid double cleanup in meson_crypto_probe()

...

can: esd_usb: kill anchored URBs before freeing netdevs

...

📄 WordPress WP2Shell SQL Injection / Remote Code Execution

This Metasploit module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137...

LightFTP Server 2.4 Race Condition

Summary Small x86-32/x64 FTP Server. Description LightFTP through version 2.4 current master, commit d28c5e0 contains multiple data races in ftpserv.c caused by unsynchronized access to the shared FTPCONTEXT between a connection's control thread and its data-transfer worker thread. In...

MiracleLinux 9 : podman-5.8.2-4.el9_8 (AXSA:2026-1491:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1491:07 advisory. golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-39835 golang.org/x/crypto/ssh:...

SUSE CVE-2026-64599

In the Linux kernel, the following vulnerability has been resolved: crypto: amlogic - avoid double cleanup in mesoncryptoprobe When mesonallocatechanlist fails after a partial allocation, it already unwinds the allocated chanlist state through its local error path. mesoncryptoprobe then jump to...

Malicious code in weight2loss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: 1 reads installer-side secrets from /.npmrc, /.ssh/,...

UBUNTU-CVE-2026-70632

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...

CVE-2026-48074

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...

CVE-2026-48074

OpenReception OpenReception: CVE-2026-48074 describes a cross-tenant data cleanup bug in Staff deletion. Before v1.0.6, deleting a staff member triggers an invite cleanup that removes from the central user_invite table by email without scoping to tenantId. As a result, a TENANT_ADMIN in one tenan...

EUVD-2026-54258

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...