CVE-2026-90289 drm/amd/display: Resize MST HDCP per-connector arrays to 32

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...

EUVD-2026-81882

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...

CVE-2026-90289 drm/amd/display: Resize MST HDCP per-connector arrays to 32

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...

CVE-2026-90118

CVE-2026-90118 is an off-by-one page overflow in the Linux kernel's NTFS filesystem driver, specifically in ntfs_decompress(). The per-token range check tests dp_addr > dp_sb_end instead of dp_addr >= dp_sb_end, allowing one byte to be written past the destination page. Because NTFS_SB_SIZE...

EUVD-2026-81711

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-90118 ntfs: fix off-by-one page overflow in ntfs_decompress()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-90118 ntfs: fix off-by-one page overflow in ntfs_decompress()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

EUVD-2026-81929

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

CVE-2026-90068

CVE-2026-90068 is an off-by-one bounds check in the Linux kernel's ASoC dapm (Digital Audio Processing Module) subsystem. The function snd_soc_dapm_put_enum_double() rejects item[0] when it reaches e->items but permits item[1] to equal that value, causing snd_soc_enum_item_to_val() to read one...

CVE-2026-90068 ASoC: dapm: Fix off-by-one check on the second enum channel

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

CVE-2026-90068 ASoC: dapm: Fix off-by-one check on the second enum channel

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

CVE-2026-89064

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

EUVD-2026-81315

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-89064

All-in-One WP Migration and Backup for WordPress (≤ 7.110 ) contains an unauthenticated Insufficient Credential Protection flaw discovered by Jakub Herman. The Ai1wm_Main_Controller::init() method, registered on the admin_init hook, reads $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] from...

CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-89064 All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

CVE-2026-90118: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-93064: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwlmvmfrobtxfkeyiter tracks the last matched byte position in loop variable 'i'. When a full key match is found match == keylen, 'i' points at the last byte of the matched...

EulerOS 2.0 SP15 : bzip2 (EulerOS-SA-2026-3801)

According to the versions of the bzip2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : bzip2 contains an offbyone error in the bzip2recover utility. When processing a specially crafted file, the application performs an outofbounds wri...

CVE-2026-82759: Use of a One-Way Hash with a Predictable Salt

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.haship/1 computes ...