CVE-2026-98153 nvme: fix racy access to FDP placement id array

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

Linux Distros Unpatched Vulnerability : CVE-2026-98153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp...

PT-2026-98815

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NVMe subsystem where the nvme query fdp info function is called per-path, leading to potential concurrent access issues. Specifically, the function populat...

automation-controller: automation-controller-container: automation-controller/AWX: Bulk Job Launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

automation-controller: automation-controller-container: automation-controller/AWX: Bulk Job Launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

CVE-2026-62278: Improper Limitation of a Pathname to a Restricted Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

PT-2026-94494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf and xdp components where bpf xdp link update calls dev xdp install directly, bypassing the checks performed in dev xdp attach. This allows a user to create an...

CVE-2026-18515

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

CVE-2026-18515

IBM i Navigator for i is vulnerable to improper path validation (CWE-22, Path Traversal), allowing a remote authenticated attacker to place files into locations in the file system that Navigator configuration intended to block. The impact is limited: the condition applies only if the user's profi...

CVE-2026-18515 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

EUVD-2026-77762

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

CVE-2026-18515 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

PT-2026-91394

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

CVE-2026-89050

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...

CVE-2026-89050: Insufficient Verification of Data Authenticity

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...

CVE-2026-84470 Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

USN-8708-1 rust-sudo-rs vulnerability

It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only...

USN-8708-1: sudo-rs vulnerability

It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only...

CVE-2026-84470: Missing Authorization

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

FreeBSD : security/sudo-rs -- sudoedit could circumvent /etc/sudoers restrictions (c0acdbac-a524-11f1-8039-589cfc103809)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c0acdbac-a524-11f1-8039-589cfc103809 advisory. Trifecta Tech Foundation reports: Users that are explicitly permitted to edit only specific files using...