CVE-2026-64174

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

EUVD-2026-45859

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

CVE-2026-64174

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

CVE-2026-64174

Technical details for CVE-2026-64174 are not provided in the connected documents. Monitor for updates and public disclosures to confirm affected products, impact, and remediation.

CVE-2026-64174 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

CVE-2026-64053 block: don't overwrite bip_vcnt in bio_integrity_copy_user()

In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bipvcnt in biointegritycopyuser biointegrityaddpage already sets bipvcnt to 1 for the bounce segment. Overwriting it with nrvecs breaks bipvcnt = bipmaxvcnt on WRITE bipmaxvcnt is 1, so the gap-merge checks...

CVE-2026-64053 block: don't overwrite bip_vcnt in bio_integrity_copy_user()

In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bipvcnt in biointegritycopyuser biointegrityaddpage already sets bipvcnt to 1 for the bounce segment. Overwriting it with nrvecs breaks bipvcnt = bipmaxvcnt on WRITE bipmaxvcnt is 1, so the gap-merge checks...

CVE-2026-64017 blk-mq: pop cached request if it is usable

In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blkmqfreeplugrqs, freeing the cachedrqs. This...

CVE-2026-64017

In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blkmqfreeplugrqs, freeing the cachedrqs. This...

EUVD-2026-45590

In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blkmqfreeplugrqs, freeing the cachedrqs. This...

EUVD-2026-45405

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching...

PT-2026-61334

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free bug exists in the blk-mq component when submitting a bio. The issue occurs if a task sleeps after peeking at a cached request but before popping it, causing the plug to...

CVE-2026-10130

QueryWeaver (CVE-2026-10130) contains an authentication bypass where the signup route unconditionally creates and links a new token to the victim Identity via a Cypher MERGE before verifying email ownership, enabling unauthenticated attackers to obtain valid session tokens for existing accounts a...

CVE-2026-10130 QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching...

CVE-2026-10130 QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching...

CVE-2026-16150

The CVE affects RobinHerbots Inputmask (versions up to 5.0.9). The vulnerability arises in the Internal Deep Merge Helper’s extendDefaults/extendDefinitions/extendAliases in lib/dependencyLibs/extend.js, causing improperly controlled modification of object prototype attributes (prototype pollutio...

CVE-2026-16150 RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution

A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled...

CVE-2026-16150 RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution

A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled...

PT-2026-60982

Name of the Vulnerable Software and Affected Versions RobinHerbots Inputmask versions prior to 5.0.10 Description An issue exists in the Internal Deep Merge Helper component within the lib/dependencyLibs/extend.js library. The functions extendDefaults, extendDefinitions, and extendAliases allow f...

CVE-2026-16150: Improperly Controlled Modification of Object Prototype Attributes

A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled...