PT-2026-70395

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to a cross-site scripting issue, which allows an authorized attacker to perform spoofing over a network...

PT-2026-70625

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to a cross-site scripting issue, which allows an authorized attacker to perform spoofing over a network...

Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core

TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. WordPress fixed the issue in 7.0.3 and...

CVE-2026-68428

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

CVE-2026-68264

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset currentop in xeptupdateopsinit xeptupdateopsinit fails to reset currentop to 0. On the vmbind path, opsexecute calls xeptupdateopsprepare inside the xevalidationguard / drmexecuntilalllocked loop. When that loop...

DEBIAN-CVE-2026-68212

In the Linux kernel, the following vulnerability has been resolved: media: saa7134: Fix a possible memory leak in saa7134videoinit1 In saa7134videoinit1, the return value of the first saa7134pgtablealloc is not checked. If it fails, the function continues as if successful, leaving the driver with...

CVE-2026-68276

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

CVE-2026-68212

In the Linux kernel, the following vulnerability has been resolved: media: saa7134: Fix a possible memory leak in saa7134videoinit1 In saa7134videoinit1, the return value of the first saa7134pgtablealloc is not checked. If it fails, the function continues as if successful, leaving the driver with...

UBUNTU-CVE-2026-68276

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

UBUNTU-CVE-2026-68212

In the Linux kernel, the following vulnerability has been resolved: media: saa7134: Fix a possible memory leak in saa7134videoinit1 In saa7134videoinit1, the return value of the first saa7134pgtablealloc is not checked. If it fails, the function continues as if successful, leaving the driver with...

UBUNTU-CVE-2026-68128

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

AZL-95058 CVE-2026-68086 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing There is no upstream commit, as this code was removed by upstream commit 044925f9b565 "mm: fs: remove filemapnrthps functions and their users" As-is, khugepaged and...

CVE-2026-68428

The CVE describes a use-after-free in KVM’s x86/mmu related to vendor module reloads, where mmu_destroy_caches() leaves pointers to caches (pte_list_desc_cache and mmu_page_header_cache) in kvm.ko. When a vendor module unload occurs while kvm.ko remains loaded, a subsequent cache initialization c...

CVE-2026-68418

CVE-2026-68418 affects the Linux kernel RDMA/irdma path, specifically QP creation. The root cause was that iwqp->iwpbl could be dereferenced unconditionally later in irdma_setup_virt_qp if a user supplied req.user_wqe_bufs, even when it was zero. Although there was a NULL check, it only applie...

CVE-2026-68276 drm/amdgpu/gfx: fix cleaner shader IB buffer overflow

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

CVE-2026-68276 drm/amdgpu/gfx: fix cleaner shader IB buffer overflow

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

EUVD-2026-55341

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drmgpusvmgetpages only stored the local dpagemap into svmpages-dpagemap on the success path. If a later page failed e.g. -EOPNOTSUPP when ctx-allowmixed is...

CVE-2026-68239 drm/ttm: Account for NULL and handle pages in ttm_pool_backup

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

CVE-2026-68212

The CVE affects the Linux kernel driver media: saa7134, specifically saa7134_video_init1. The issue is a memory leak risk caused by missing return-value checks on two saa7134_pgtable_alloc() calls and incomplete error handling when vb2_queue_init() for the VBI queue fails. If a pgtable allocation...

CVE-2026-68212 media: saa7134: Fix a possible memory leak in saa7134_video_init1

In the Linux kernel, the following vulnerability has been resolved: media: saa7134: Fix a possible memory leak in saa7134videoinit1 In saa7134videoinit1, the return value of the first saa7134pgtablealloc is not checked. If it fails, the function continues as if successful, leaving the driver with...