CVE-2026-80821

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on createcq mapping failure nvmetpciepfcreatecq calls nvmetcqcreate, which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or...

CVE-2026-80821

CVE-2026-80821 affects the Linux kernel 's nvmet pci-epf driver (NVM Express over Fabrics Target, PCIe Endpoint Function). The vulnerability is a reference leak in nvmet_pci_epf_create_cq(): when PCI address-space mapping fails or returns a too-small partial mapping after nvmet_cq_create() succee...

CVE-2026-80821 nvmet: pci-epf: put CQ ref on create_cq mapping failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on createcq mapping failure nvmetpciepfcreatecq calls nvmetcqcreate, which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or...

EUVD-2026-71263

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on createcq mapping failure nvmetpciepfcreatecq calls nvmetcqcreate, which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or...

EUVD-2026-71243

In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated xattr cache entries ext4xattrblockset retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry returns to the mbcache lookup without makin...

EUVD-2026-71401

In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-after-free on final put futexprivatehashput drops the reference to fph before evaluating fph-mm for wakeupvar. futexrefput enables preemption again before returning. If that put drops the final...

MINI-WQ72-P6X2-W385

Bulletin has no description...

CVE-2026-85615

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

CVE-2026-85615

Openpanel before 2.3.0 is affected by an insecure direct object reference (IDOR) vulnerability in the report.getLayouts and report.resetLayout tRPC procedures. The root cause is a failure to bind dashboardId to the authorized projectId , allowing an authenticated attacker to supply an arbitrary v...

CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Rafie Muhammad in WordPress Theme WP Rentals versions 3.16.0...

GHSA-V7PH-R5R6-4JCJ

creationtimestamp| type| source ---|---|--- 2026-09-04 08:32:32+00:00| seen| https://gist.github.com/alon710/4e3a59a46f5538004facf996eb24fc2d...

Malicious Package

Overview ecs-api-reference is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CGA-RVXG-9MHW-F8QQ

Bulletin has no description...

CGA-HPJH-GQW6-R3RM

Bulletin has no description...

CVE-2026-85615: Authorization Bypass Through User-Controlled Key

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

PT-2026-86189

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the netfs pgpriv2 copy to cache function where a folio is marked with PG private 2 before being appended to the copy-to-cache rolling buffer via netfs pgpriv2 copy...

Linux Distros Unpatched Vulnerability : CVE-2026-80841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backe...

CVE-2026-80888: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...