PT-2026-94844

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access in the property array occurs when the software node get reference args function is called with an index of UINT MAX representing -1, as the bounds check fails to...

PT-2026-94367

Name of the Vulnerable Software and Affected Versions b2evolution CMS versions 6.7.8 through 7.2.5 Description An incomplete fix in the param check serialized array function fails to reject payloads containing negative integer array keys. Unauthenticated attackers can send crafted serialized PHP...

CVE-2026-76834: Deserialization of Untrusted Data

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in paramcheckserializedarray fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit crafted serialized PHP objects via POST...

CVE-2026-93046: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs was failing when passed UINTMAX, this in turn would lead to an out of bound access in the propert...

PT-2026-95188

Name of the Vulnerable Software and Affected Versions snappy-java versions prior to 1.1.10.9 Description A buffer overflow exists in typed Snappy.uncompressArray methods. The issue occurs because output arrays are allocated by dividing the uncompressed length by the element size, but the undivide...

CVE-2026-90390: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: resume array on backlogstore error path backlogstore suspends the array before checking whether a write-mostly device exists. If no such device exists, the error path only unlocks reconfigmutex and leaves the array...

PT-2026-94697

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array access exists in the mt7996 tx function within the mt76 wifi driver. When mac80211 leaves the link unspecified, the function uses a primary link id that may be set...

PT-2026-94918

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An array-index-out-of-bounds issue exists in the UAC1 and UAC2 configfs rate-list attributes. The system parses a comma-separated list of sampling rates and stores them in fixed-size...

CVE-2026-93122: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

PT-2026-94733

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1.3 Description An issue exists in the md/raid1 component where adding a new rdev to an existing RAID1 array with the serialize policy enabled can lead to a system crash. This occurs because the bind rdev to array...

PT-2026-94776

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tegra241 cmdqv probe function where the error IRQ is requested before the cmdqv-vintfs array is allocated and cmdqv-num vintfs is set. If a CMDQV remains enabled...

PT-2026-94786

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the scsi ufs core where connected lane counts are not properly validated. These counts are used by the TX equalization code to index arrays sized by UFS MAX LANES...

CVE-2026-92581

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

CVE-2026-92581

In AVideo through 29.0 , the Like::__construct() method performs counter arithmetic on raw request values before validation. This allows array-typed parameters to desynchronize stored votes from denormalized counters. An authenticated attacker can send array-typed like parameters followed by ordi...

CVE-2026-92581 AVideo through 29.0 Like Counter Desynchronization via Array Parameter

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

CVE-2026-92581 AVideo through 29.0 Like Counter Desynchronization via Array Parameter

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

CVE-2026-92581 AVideo through 29.0 Like Counter Desynchronization via Array Parameter

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

AZL-101592 CVE-2026-90025 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM response after checking it is not 0xff. The port altmode array is...

DEBIAN-CVE-2026-89904

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix acpipackageids array overflow With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets packages on one VM. With PPTT acpi table, array acpipackageids will be overflowed. Her...

CVE-2026-89904

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix acpipackageids array overflow With LoongArch virt machine, a typical setting is one core per socket, there will max 256 sockets packages on one VM. With PPTT acpi table, array acpipackageids will be overflowed. Her...