CVE-2026-50013: Concurrent Execution using Shared Resource with Improper Synchronization

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy,...

CVE-2026-89761: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aavecunique null terminates at vecn - dups when VECFLAGTERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

CVE-2026-89725: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

CVE-2026-89644: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

CVE-2026-89611: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89649: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

CVE-2026-89772: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-54240: Integer Overflow or Wraparound

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially...

PT-2026-90213

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs prepare cdm array sizes each client debug keyword buffer with strcspncds head, " ", but then parses the keyword with %s. The %s conversion skips leading...

PT-2026-90368

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get name ceph get name copies the MDS-supplied name into the caller's NAME MAX-sized buffer with memcpyname, rinfo-dname, rinfo-dname len and then writes namerinfo-dname len = 0...

CVE-2026-89505: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...

PT-2026-90477

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa vec unique null terminates at vecn - dups when VEC FLAG TERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

PT-2026-90065

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996 mcu get eeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le3...

PT-2026-90212

In the Linux kernel, the following vulnerability has been resolved: ocfs2: always run deallocs on copy-on-write completion Local fuzzing of 6.12.94 has found the following memory leak caused by doing 'copy file range' within the same filesystem: unreferenced object 0xffff88812192c980 size 32: com...

PT-2026-89886

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2026-89487: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89158: Integer Overflow or Wraparound

PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...

CVE-2026-89157: Integer Overflow or Wraparound

PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...

PT-2026-89763

PCRE2 before 10.48, on 32-bit platforms, has a pcre2 pattern convert out-of-bounds write when an attacker can provide a large pattern...

PT-2026-90413

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh want write for early-verified SETATTR in nfsd proc setattr The BOTH TIME SET branch calls fh verify early so setattr prepare can inspect the dentry. This causes nfsd setattr to skip fh want write, so notify change ru...