PT-2026-89845

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the json decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php ...

PT-2026-90330

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcn empty bits per page is sized from vol-nr clusters at mount, but ntfs cluster alloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...

PT-2026-90437

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range max register The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. max register names 0x10000, one register past the end o...

PT-2026-90416

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listener set nfsd sock nl policy declares NFSD A SOCK ADDR as a bare NLA BINARY attribute with no minimum length. A CAP NET ADMIN caller can send a 16-byte NFSD A SOCK ADDR with sa...

PT-2026-90210

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm mig lockres handler A node receiving a DLM MIG LOCKRES message trusts several fields of the peer-supplied dlm migratable lockres without validation. num locks and lockname len are bounded only on th...

PT-2026-90442

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2 string.c: fix out-of-bounds read in ucs2 strnlen Patch series "lib/ucs2 string.c: fix out-of-bounds read in ucs2 strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2 strnlen. The first patch is the re...

CVE-2026-89633: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

PT-2026-90110

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out of sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc connection and every store to one is a read-modify-write of the other two...

PT-2026-90089

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cache pos decode takes the persisted key tail and dirty tail seg off from the cache device and addresses within the segment with it. A seg off at or past the segment data size,...

PT-2026-90092

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cache info cache segs init iterates cache info-n segs times indexing cache-segments, which is sized to the cache device geometry, and get seg id takes each segment id from the...

PT-2026-90141

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hp init bios package attribute validates obj-package.count and then calls one of the five ...

PT-2026-90365

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in build xattrs build xattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

PT-2026-90459

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm sendrecv msg locked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy...

PT-2026-90337

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221 raw event mcp2221 raw event never validates the size of incoming HID reports. In the MCP2221 I2C GET DATA path it trusts the device-supplied data3 as the copy length without checking...

CVE-2026-89722: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pciwritelegacyio pciwritelegacyio loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if count != 1 && count != 2 && count != 4 return -EINVAL; return...

CVE-2026-88914: Integer Overflow or Wraparound

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2026-13326: Out-of-bounds Read

An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag...

CVE-2026-89259: Execution with Unnecessary Privileges

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89443: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

CVE-2026-89698: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...