CVE-2026-80937

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80935

CVE-2026-80935 affects the Linux kernel mt76 Wi-Fi driver for MediaTek MT7996 devices. The function mt7996_mcu_get_eeprom() uses a device-controlled 32-bit address (event->addr) as a destination offset into dev->mt76.eeprom.data without bounds-checking it, only clamping the copy length. A m...

CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

EUVD-2026-76258

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-57843

NetBSD contains an information disclosure vulnerability in mmopen within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PKKMEM process flag. Attackers can...

EUVD-2026-76107

NetBSD contains an information disclosure vulnerability in mmopen within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PKKMEM process flag. Attackers can...

CVE-2026-57843

CVE-2026-57843 is an information disclosure vulnerability in NetBSD affecting the mm_open() function in sys/dev/mm.c. The root cause is that world-accessible devices such as /dev/null and /dev/zero are incorrectly assigned the PK_KMEM process flag. This allows unprivileged local users to bypass t...

CVE-2026-89459: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIYPERCPU with older binutils Commit a737737cdb9c "s390/percpu: Infrastructure for more efficient thiscpu operations" introduced MVIYPERCPU, which stringifies arguments that are already C string literals. This...

PT-2026-96557

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996 mcu get eeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le3...

CVE-2026-14559: Improper Authentication

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...

CVE-2026-89581: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-80935: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

PT-2026-90444

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access occurs in the Renesas I3C controller during Dynamic Address Assignment DAA, a process where the controller assigns addresses to devices on the bus. The controller...

PT-2026-89875

Name of the Vulnerable Software and Affected Versions NetBSD affected versions not specified Description An information disclosure issue exists in the mm open function within sys/dev/mm.c. Unprivileged local users can obtain real kernel virtual addresses by opening world-accessible devices, such ...

PT-2026-90067

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the mt7915 mcu get eeprom function. The issue occurs when a fixed EFUSE block is copied into the dev-mt76.eeprom.data buffer using an offset provided by...

PT-2026-90146

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the amd stb s2d init function where the return values of several S2D SMU commands are discarded. This leads to the masking of real errors, which are instead reported as...

artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address

A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray method uses ObjectInputStream.readObject to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...