PT-2026-116920

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH MAX MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

PT-2026-116975

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3 pci probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pci set drvdata, while the second...

PT-2026-116978

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec partner desc in cd321x update work cd321x update work passes a stack-allocated typec partner desc to typec register partner after initializing only usb pd, accessory and identity. typec...

PT-2026-116979

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec partner desc in tps6598x connect tps6598x connect passes a stack-allocated typec partner desc to typec register partner after initializing only usb pd, accessory and identity. typec...

PT-2026-117064

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

PT-2026-116943

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nr descs zero, so nvmet pci epf get sgl segment reads the type byte of sgls-1 outside...

PT-2026-116982

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep in and ep out for non-ep0 control endpoints In usb enable endpoint, non-zero control endpoints where usb endpoint xfer control&ep-desc is true populate both dev-ep inepnum and dev-ep outepnum with the sam...

PT-2026-116766

In the Linux kernel, the following vulnerability has been resolved: af packet: fix integer overflow in prb calc retire blk tmo prb calc retire blk tmo computes in 32-bit int arithmetic: mbits = blk size in bytes 8 / 1024 1024; If I'm reading the validation right, tp block size is user controlled...

PT-2026-116790

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf-page after recycling on skb build failure In stmmac rx, when napi build skb fails the descriptor page is recycled back to the page pool with page pool recycle direct, but buf-page is left pointing at...

PT-2026-116878

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read...

PT-2026-117018

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpf tramp image put makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

PT-2026-117037

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfree rcu sheaf Since kfree rcu can be called under pi lock a raw spinlock in the scheduler, kfree rcu itself should never allocate memory with GFP KSWAPD RECLAIM as waking up kswapd ends up...

PT-2026-116792

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skb checksum setup ipv6 skb maybe pull tail subtracts skb headlenskb from the unsigned max argument and passes the result to pskb pull tail as a signed int. The function does not ensure th...

PT-2026-116542

A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of...

PT-2026-116544

A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub...

PT-2026-116628

A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get obj from str of the file modules/sd models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotel...

PT-2026-117166

A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack...

PT-2026-117167

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was...

PT-2026-116601

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create item html of the file modules/ui extra networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initia...

PT-2026-116627

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read metadata from safetensors of the file modules/sd models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. ...