PT-2026-70952

In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d "smp: Improve smp call function single CSD-lock diagnostics" changed smp call function single so that, when CSD lock debugging is enabled, async !wait calls...

PT-2026-70943

In the Linux kernel, the following vulnerability has been resolved: drm/dp mst: Handle torn-down topology gracefully in drm dp mst topology queue probe A hotplug or link-loss event can tear down the MST topology setting mgr-mst state = false and mgr-mst primary = NULL concurrently with a caller...

PT-2026-71226

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description An improper validation issue in the instancePostMigration function within lxd/instance post.go allows an authenticated attacker with can create instances permissions on a restricted project to...

PT-2026-71225

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...

Linux Distros Unpatched Vulnerability : CVE-2026-68429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe A hotplug or link- loss event can tear down the MST topology setting mgr-mststate ...

TencentOS Server 4: sssd (TSSA-2026:0827)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0827 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-68441

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: Handle TCACTREDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TCACTREDIRECT ex: via an eBPF program calling...

The vulnerability of the Import/Export Data function of the pgAdmin 4 database management tool, which allows a hacker to execute arbitrary operating system commands on the server.

The vulnerability of the Import/Export Data function of the pgAdmin 4 database management tool is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands on the server remotely...

The vulnerability of the driver for the afd.sys auxiliary function in Windows Sockets operating systems allows a hacker to increase their privileges.

The vulnerability of the driver for the afd.sys auxiliary function in Windows Sockets operating systems is related to the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the mechanism for recording audit entries for system calls to the ptrace() function in the operating system kernel of FreeBSD allows a perpetrator to bypass existing security mechanisms.

The vulnerability of the mechanism for recording audit entries for system calls to the ptrace function in FreeBSD operating systems is related to security configuration errors. Exploiting this vulnerability can allow attackers to bypass existing security mechanisms...

The vulnerability of the zfs_ioc_userspace_many() function in the OpenZFS component of FreeBSD-based operating systems allows a attacker to increase their privileges.

The vulnerability of the zfsiocuserspacemany function in the OpenZFS component of FreeBSD operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to gain increased privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-68089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer will not initialize the start of buf. Non zero values for ppos aren't...

PT-2026-71355

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

The vulnerability of the btrfs_clear_space_info_full() function in the btrfs module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the btrfsclearspaceinfofull function in the btrfs module of the Linux operating system is related to the allocation of unlimited memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-68387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: raw: add locking for raw flags bitfield With commit 890e5198a6e5 can: raw: use bitfields to store flags in struct rawsock the formerly separate integer...

Linux Distros Unpatched Vulnerability : CVE-2026-71266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpylinebuf, p,...

PT-2026-71137

Multiple Use-After-Free vulnerabilities were found in the add archive element function in ld/ldmain.c of the GNU linker ld, a component of binutils. The root cause is that plugin maybe claim in ld/plugin.c frees the original BFD object via bfd close/ bfd delete bfd when entry-the bfd-my archive =...

PT-2026-71146

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

The vulnerability of the have_mon_and_osd_map() function in the net/ceph/ceph_common.c kernel module of the Linux operating system allows a hacker to induce a service failure.

The vulnerability of the havemonandosdmap function in the net/ceph/cephcommon.c kernel module of the Linux operating system is related to the dereferencing of a pointer with an expired lifetime. Exploiting this vulnerability could allow an attacker to trigger a service failure...

MAL-2026-13933 Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...