Combining encryption settings may disable encryption

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database...

CVE-2026-90126

In the Linux kernel, the following vulnerability has been resolved: rtc: pcf8563: fix clock provider leak on unbind pcf8563clkoutregisterclk registers the CLKOUT clock provider with ofclkaddprovider, but nothing ever unwinds it: there is no ofclkdelprovider call and the driver has no remove...

DEBIAN-CVE-2026-90126

In the Linux kernel, the following vulnerability has been resolved: rtc: pcf8563: fix clock provider leak on unbind pcf8563clkoutregisterclk registers the CLKOUT clock provider with ofclkaddprovider, but nothing ever unwinds it: there is no ofclkdelprovider call and the driver has no remove...

CVE-2026-90126 rtc: pcf8563: fix clock provider leak on unbind

In the Linux kernel, the following vulnerability has been resolved: rtc: pcf8563: fix clock provider leak on unbind pcf8563clkoutregisterclk registers the CLKOUT clock provider with ofclkaddprovider, but nothing ever unwinds it: there is no ofclkdelprovider call and the driver has no remove...

CVE-2026-90126

CVE-2026-90126 affects the pcf8563 RTC driver in the Linux kernel . The function pcf8563_clkout_register_clk() registers a CLKOUT clock provider via of_clk_add_provider() but never unwinds it—there is no matching of_clk_del_provider() call and the driver lacks a remove callback. As a result, ever...

CVE-2026-90126 rtc: pcf8563: fix clock provider leak on unbind

In the Linux kernel, the following vulnerability has been resolved: rtc: pcf8563: fix clock provider leak on unbind pcf8563clkoutregisterclk registers the CLKOUT clock provider with ofclkaddprovider, but nothing ever unwinds it: there is no ofclkdelprovider call and the driver has no remove...

EUVD-2026-81719

In the Linux kernel, the following vulnerability has been resolved: rtc: pcf8563: fix clock provider leak on unbind pcf8563clkoutregisterclk registers the CLKOUT clock provider with ofclkaddprovider, but nothing ever unwinds it: there is no ofclkdelprovider call and the driver has no remove...

CVE-2026-91039

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...

Marten's LINQ provider has SQL injection via unescaped string literals

Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote ' could break out of the literal...

GHSA-RFX3-98H7-V3XP Marten's LINQ provider has SQL injection via unescaped string literals

Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote ' could break out of the literal...

PT-2026-95131

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia Premium version versions prior to 2.4.5 Description Unauthorized access and modification of data occur due to missing ownership verification on the '/users/customers/' endpoint. Authenticat...

CVE-2026-92757: Missing Encryption of Sensitive Data

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

Fedora 45 : sblim-cmpi-base (2026-700fe12346)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-700fe12346 advisory. Use mktemp for temporary files in provider registration script CVE-2026-73585 Tenable has extracted the preceding description block directly from th...

CVE-2026-78425: Improper Authentication

Authorised users of outside applications behind the same corporate identity provider IdP, for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is...

CVE-2026-91039: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in...

CVE-2026-90069: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - allocate async request context when cloning ACOMPREQUESTONSTACK reserves only enough storage for the synchronous fallback. When an async implementation is selected, callers clone that stack request before retrying...

CVE-2026-14311: Missing Authorization

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

Oracle Linux 10 : openssl (ELSA-2026-500326)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500326 advisory. 3.5.8-1.0.1 - Replace upstream references Orabug: 34340177 - Update FIPS provider name Orabug: 35824276 1:3.5.8-1 - Rebase to OpenSSL 3.5.8 Resolves...

PT-2026-95049

Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote ' could break out of the literal...

PT-2026-95072

Name of the Vulnerable Software and Affected Versions MongoDB Entity Framework Core Provider affected versions not specified Description Applications using this provider that combine independent encryption settings with the provider's own encryption settings may silently lose TLS Transport Layer...