PT-2026-82137

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the af unix module where the garbage collector GC may partially free a dead Strongly Connected Component SCC. This occurs during a race condition when unix add edges...

CVE-2025-70293

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fsgetbgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy which could lead to arbitrary code execution, a denial of service,...

PT-2026-81980

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbw get hash key function that uses the current user's identity instead of the cookie username...

The vulnerability of the vub300_disconnect() function in the drivers/mmc/host/vub300.c module of the MMC/SD/SDIO card driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the vub300disconnect function in the drivers/mmc/host/vub300.c module of the MMC/SD/SDIO card driver for the Linux operating system is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the evhttp_find_header() function in the evhttp HTTP parser library from the asynchronous event notification library Libevent allows a attacker to cause a service failure.

The vulnerability of the evhttpfindheader function in the evhttp HTTP parser from the Libevent asynchronous event handling library is related to deficiencies in HTTP request processing. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the do_become_nonbusy() function in the drivers/comedi/comedi_fops.c module of the Linux kernel allows a attacker to cause a service failure.

The vulnerability of the dobecomenonbusy function in the drivers/comedi/comedifops.c module of the Linux kernel is related to improper memory release memory leak. Exploiting this vulnerability can allow a remote attacker to cause service failure...

The vulnerability of the rz_mtu3_count_enable_write() function in the drivers/counter/rz-mtu3-cnt.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rzmtu3countenablewrite function in the drivers/counter/rz-mtu3-cnt.c module of the Linux kernel is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability in the requestInternal HTTP redirection processing function of the urllib package in the Node.js npm package stack allows attackers to access protected information.

The vulnerability of the requestInternal handling function in the urllib package of the Node.js npm package stack involves exposing confidential information to unauthorized entities. Exploiting this vulnerability could allow a malicious actor to gain access to protected information...

The vulnerability of the st_lsm6dsx_fifo_setup() function in the drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c driver module allows attackers to compromise the confidentiality, integrity, and accessibility of protected information in various types of embedded sensors integrated into the Linux operating system.

The vulnerability of the stlsm6dsxfifosetup function in the drivers/iio/imu/stlsm6dsx/stlsm6dsxbuffer.c module of various types of embedded sensors in the Linux operating system is related to reading beyond the buffer’s boundaries. Exploiting this vulnerability could allow an attacker to compromi...

The vulnerability of the evtag_unmarshal_header() function in the Libevent asynchronous event notification library allows a attacker to cause a service failure.

The vulnerability of the evtagunmarshalheader function in the Libevent asynchronous event notification library is related to integer overflow. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the formcreateFileName() function in the /goform/formcreateFileName file of the Tenda CH22 router’s microprogramming system allows a attacker to execute arbitrary commands.

The vulnerability of the formcreateFileName function in the /goform/formcreateFileName file of the Tenda CH22 router microprogramming system is related to the failure to take measures to eliminate special elements in the output data. Exploiting this vulnerability may allow a remote attacker to...

The vulnerability of the qla24xx_els_dcmd_iocb() function in the drivers/scsi/qla2xxx/qla_iocb.c driver for SCSI devices in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the qla24xxelsdcmdiocb function in the drivers/scsi/qla2xxx/qlaiocb.c driver for Linux SCSI device drivers is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and...

The vulnerability of the reset_add gpio_aux_device() function in the drivers/reset/core.c file of the Linux kernel-based universal reset controller driver allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the resetadd gpioauxdevice function in the drivers/reset/core.c file of the Linux kernel-based universal reset controller driver relates to the repeated release of previously released memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

The vulnerability of the rxrpc_preparse_xdr_yfs_rxgk() function in the net/rxrpc/key.c module, which is part of the RxRPC session support in the Linux operating system’s kernel, allows a attacker to cause a service failure.

The vulnerability of the rxrpcpreparsexdryfsrxgk function in the net/rxrpc/key.c module, which is part of the RxRPC session support in the Linux operating system’s kernel, involves the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an...

The vulnerability of the evws_new_session() function in the Libevent asynchronous event notification library allows a hacker to trigger a service failure.

The vulnerability of the evwsnewsession function in the Libevent asynchronous event notification library is related to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a attacker to cause a service failure...

PT-2026-82126

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter flowtable where the nf flow table iterate function only treats original-direction tuple nodes as owning entries. This allows the Garbage Collector GC to...

PT-2026-82212

Name of the Vulnerable Software and Affected Versions FiftyOne affected versions not specified Description The application renders a dataset field's description as markup without proper sanitization or escaping. Specifically, the sidebar field-information component located at...

CVE-2025-70293

CVE-2025-70293 affects Denx U-Boot before version 2026.04 . An integer overflow in the function ext4fs_get_bgdtable causes an under-allocated buffer to be passed to memcpy() , resulting in a heap buffer overflow. This can lead to arbitrary code execution , denial of service , or other unspecified...

PT-2026-82078

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.18 Description The injectSecurityTab function within the BlueprintController fails to apply the API-key scope cap when determining if a page's security or permissions blueprint...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpng12 (UTSA-2026-093176)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093176 advisory. Heap-based buffer overflow in the pngcombinerow function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-depende...