CVE-2026-93165: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

CVE-2026-90433: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

CVE-2026-90410: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: davinci: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestthreadedirq. During removal, spibitbangstop only unregisters th...

CVE-2026-90397: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

CVE-2026-90193: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

CVE-2026-12284: Origin Validation Error

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

CVE-2026-92860: Improper Input Validation

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. Th...

CVE-2026-86709: Improper Authentication

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-92839: Double Decoding of the Same Data

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session...

PT-2026-94910

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the san probe function when installing the GSBUS address space handler. This happens because the function dereferences the result of ACPI COMPANION...

PT-2026-94142

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs in the device control handler when multiple threads issue concurrent IOCTL Input/Output Control requests. This issue is caused by improp...

PT-2026-94654

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ARM architecture implementation where the hw breakpoint cfi handler stub incorrectly claims breakpoint type 0x03 ARM ENTRY CFI BREAKPOINT even when Control Flow...

PT-2026-94157

Name of the Vulnerable Software and Affected Versions Paid Downloads versions prior to 3.16 Description The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the admin request handler function. This occurs because the function lacks proper authorization and...

PT-2026-94822

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/erdma component. The CEQ interrupt handler schedules eqc-tasklet, which executes the erdma ceq completion handler function to read the...

PT-2026-94541

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A self-deadlock occurs in the IRQ handler of the qcom-cpucp mailbox. The function qcom cpucp mbox irq fn calls mbox chan received data while holding chan-lock. In PREEMPT RT...

PT-2026-94456

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the SMC LLC Shared Memory Communications Local LLC implementation. When the smc llc event handler function transitions a local LLC flow from SMC LLC FLOW REQ ADD...

PT-2026-94961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory overread exists in the ring handler of the sensorhub component. The issue occurs because max response and sensor num are retrieved from different Embedded Controller EC commands...

PT-2026-94246

Name of the Vulnerable Software and Affected Versions rcourtman Pulse versions 6.0.4 and 6.1.0-rc.4 Description Improper input validation occurs in the Quick Security Setup Handler component when processing the Username argument within the fmt.Sprintf function at the '/api/security/quick-setup'...

PT-2026-94164

Name of the Vulnerable Software and Affected Versions Pressengine WordPress plugin versions prior to 1.1 Description The login handler fails to prevent the issuance of a session when authentication fails. This allows unauthenticated attackers to bypass authentication and log in as any user,...

Linux Distros Unpatched Vulnerability : CVE-2026-92399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in GPAC 26.07.0. This affects the function rmtclienthandlewsframe of the file src/utils/rmtws.c of the component WebSocket Handle...