PT-2026-116685

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 component where the fix host ownership function only processes the linear-map alias of each memblock region. Consequently, the per-CPU hyp stack, which i...

PT-2026-116765

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 boot process where the init el2 fgt2 function writes the same mask to both HDFGRTR2 EL2 and HDFGWTR2 EL2. Because PMZR EL0 is write-only, its trap bit nPMZR...

PT-2026-116690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM SEV implementation during intra-host migration. The source VM is converted to a non-SEV VM, which prevents KVM memory reclaim flows from triggering necessary...

Linux Distros Unpatched Vulnerability : CVE-2026-98834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd unregisters the...

Linux Distros Unpatched Vulnerability : CVE-2026-98471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to...

Linux Distros Unpatched Vulnerability : CVE-2026-98769

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fuac1legacy: validate bRequest index in genericset,getcmd genericsetcmd and genericgetcmd use the low nibble of ctrl-bRequest as an index into...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel from 6.12.25 to 6.12.112 and from 6.14.4 to 6.15 contain security vulnerabilities. The vulnerability arises from the function initel2fgt2, which writes the same mask to HDFGRTR2EL2 and HDFGWTR2EL2. However, PMZREL0 is only write-only, and its trap bit nPMZREL0 exists...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.4 contains a security vulnerability. This vulnerability arises from the fact that virtiogpuresourcecreateioctl calls drmgemhandlecreate at the erroneous path, causing drmgemobjectrelease to be called without properly releasing the references it holds. As a result,...

Omnigent path traversal vulnerability

In versions prior to Omnigent 0.14.0 and 0.3.0, there was a path traversal vulnerability. This vulnerability stems from path traversal attacks. Certified users can escape the working directory by setting up nested sub-proxies in os.env.cwd. They can also upload bundles that utilize absolute or...

MSC-2026-12899

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12896

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12900

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12897

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12894

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12898

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12895

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

CVE-2026-106470

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

EUVD-2026-103256

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

Apache Airflow SSH and SFTP Providers 6.0.1 Host Key Verification

Apache Airflow SSH and SFTP providers through version 6.0.1 disable SSH host key verification by default, allowing a man-in-the-middle attacker to impersonate an SSH server. This proof of concept demonstrates acceptance of an untrusted server key. https://packetstorm.news/download/236119...

PT-2026-116369

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.88 Description Insufficient authorization and Cross-Site Request Forgery CSRF checks in a specific action allow authenticated users, including those with subscriber privileges, to perform Server-Side Reques...