CVE-2026-57225: NULL Pointer Dereference

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset valuekey resolves to a string. A trusted or untrusted dataset or rule feed...

Linux Distros Unpatched Vulnerability : CVE-2026-93096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox...

ROS-20260918-73-0123

The vulnerability of the mm/pagealloc.c component in the Linux operating system’s kernel is related to a race condition involving context switching. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-95499

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions prior to 7.2.0 Description Semantic MediaWiki is an open-source extension for MediaWiki used for storing and querying data. The software fails to apply sufficient output-context encoding when the value parameter is...

CVE-2026-77608: Improper Neutralization of Input During Web Page Generation

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

PT-2026-95480

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.19.6 Description An integer overflow occurs in the Op RGB24 32 to YCbCr::convert colorspace function when processing extremely large RGB images created via heif image create and heif image add plane. This overflow...

CVE-2026-79713: Inconsistent Interpretation of HTTP Requests

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...

Linux Distros Unpatched Vulnerability : CVE-2026-90098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address...

Linux Distros Unpatched Vulnerability : CVE-2026-90240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alia...

Linux Distros Unpatched Vulnerability : CVE-2026-90094

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part...

djust: A template binding inherits a context safety grant it never earned (XSS)

A context safety grant was inherited by a template binding that never earned it, so rebinding a name the view had marked safe left the mark attached to the new, attacker-controlled value. djust's context safety channel is keyed by name, not by value. Every bind copied the value and left the grant...

GHSA-XJW9-38CR-6372 djust: A template binding inherits a context safety grant it never earned (XSS)

A context safety grant was inherited by a template binding that never earned it, so rebinding a name the view had marked safe left the mark attached to the new, attacker-controlled value. djust's context safety channel is keyed by name, not by value. Every bind copied the value and left the grant...

Improper Encoding or Escaping of Output

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via improper handling of...

AZL-102807 CVE-2026-93191 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smack: fix incorrect task context in smackmsgqueuemsgrcv The smackmsgqueuemsgrcv function incorrectly checks the permissions of the 'current' task instead of the 'target' task. In the msgsnd syscall path, if a receiver is already...

CVE-2026-93096

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mboxmutex only serializes individual mailbox commands and is...

CVE-2026-90381

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

AZL-102504 CVE-2026-90383 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

DEBIAN-CVE-2026-90381

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

CVE-2026-90338

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011consolewriteatomic runs from nbcon atomic context, where sleeping is not allowed. It calls clkenable, which takes the common-clk enablelock. Under PREEMPTRT th...

CVE-2026-90255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...