SUSE CVE-2026-90354

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915pciinithif2 was called unconditionally and again inside the WED-inactive branch. The helper increments the global hifidx, writes the PCIe RECOGID register and tak...

SUSE CVE-2026-93059

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the else branch, leaking a reference on every GPU hang recovery. Patchwork...

SUSE CVE-2026-93163

In the Linux kernel, the following vulnerability has been resolved: hwrng: core - fix rng list on registration error hwrngregisterrng does the following: 1. Checks if rng has name and read methods set 2. Checks if the name already exists 3. Adds rng to global rnglist 4. May try to set rng to...

SUSE CVE-2026-93193

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Fix OF node reference leak via auto cleanup Sashiko reported a reference leak in rockchipdpdrmencoderenable, the ofgetchildbyname function does not call ofnodeput in a symmetrical way 1. Fix the device...

PT-2026-95399

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A reference-count leak exists in the HAProxy PROXY-v2 message decoder. A remote, unauthenticated attacker can exploit this by sending specially crafted PROXY-protocol v2 headers, specifically...

Linux Distros Unpatched Vulnerability : CVE-2026-90242

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one...

Linux Distros Unpatched Vulnerability : CVE-2026-93105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - esp: do not unref managed frag pages in espssgunref espssgunref releases the page references held on the source scatterlist after the AEAD operation completes. ...

Linux Distros Unpatched Vulnerability : CVE-2026-90352

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off...

Linux Distros Unpatched Vulnerability : CVE-2026-93163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwrng: core - fix rng list on registration error hwrngregisterrng does the following: 1. Checks if rng has name and read methods set 2. Checks if the name alrea...

CVE-2026-93564: Undefined Security Weakness

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

CVE-2026-13471: Authorization Bypass Through User-Controlled Key

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it...

CVE-2026-92714: Authorization Bypass Through User-Controlled Key

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

CVE-2026-18441: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

PT-2026-95236

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description The plugin fails to perform per-object authorization checks for image-optimization actions. It relies on a coarse capability shared by lower-privileged users and does not verify...

Linux Distros Unpatched Vulnerability : CVE-2026-93106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crashdump: release keyring reference at the correct time restoredmcryptkeystothreadkeyring gets a reference to the user keyring before restoring the saved...

Linux Distros Unpatched Vulnerability : CVE-2026-90298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/sun4i: tcon: Drop TCON TOP device reference offinddevicebynode takes a device reference. Drop it after mux configuration succeeds. CVE-2026-90298 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-90354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915pciinithif2 was called unconditionally and again inside the WED-inactive branch. The helper...

ROS-20260918-73-0107

The vulnerability in the kernel-lt is related to the use of a name with an incorrect reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-93375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-90215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: ubi: Release device reference on busy detach ubidetachmtddev obtains a device reference through ubigetdevice before checking whether the UBI device is busy...