PT-2026-99247

Name of the Vulnerable Software and Affected Versions WP Delicious WordPress plugin versions prior to 1.10.8 Description Insufficient validation and escaping of HTML tag names derived from user-supplied recipe block data allows users with the Contributor role and above to inject arbitrary HTML...

SUSE CVE-2026-93257

In the Linux kernel, the following vulnerability has been resolved: block: handle nogenerate/noverify properly in fs-integrity Check the BIPCHECK flags before generating or verifying PI information, otherwise this can be incorrectly called for non-PI metadata and cause generation of incorrect...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

DEBIAN-CVE-2026-98081

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

CVE-2026-97997

In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...

DEBIAN-CVE-2026-97997

In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...

DEBIAN-CVE-2026-97585

In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afseditdirremove to use a cleanup function to unmap the block pointed to by afsdiriter::block if it's left pointing to something rather than manually kunmapping the blocks. Manually...

CVE-2026-97549

In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on XFS for-next as of 7.3-rc2 with MKFSOPTIONS="-n size=8192", I observed the following trimmed dmesg splat: XFS: Assertion failed: args-total =...

UBUNTU-CVE-2026-98045

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

UBUNTU-CVE-2026-97549

In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on XFS for-next as of 7.3-rc2 with MKFSOPTIONS="-n size=8192", I observed the following trimmed dmesg splat: XFS: Assertion failed: args-total =...

UBUNTU-CVE-2026-97997

In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...

UBUNTU-CVE-2026-97585

In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afseditdirremove to use a cleanup function to unmap the block pointed to by afsdiriter::block if it's left pointing to something rather than manually kunmapping the blocks. Manually...

CVE-2026-98045

The Linux kernel contains a vulnerability where the faultable variants of bpf_get_stack() and bpf_get_task_stack() do not correctly set the might_sleep property. This allows these helpers to be called from non-sleepable regions, such as RCU or preemption-disabled regions, because the verifier may...

CVE-2026-97997

The Linux kernel contains a vulnerability in the virtio_ring component where a failed packed add can leave stale AVAIL and USED bits in the descriptors. When vring_map_one_sg() fails mid-operation, unmap_release restores flags but leaves descriptors marked as available. This causes the device to ...

CVE-2026-97588 s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persistently returns -EBUSY after exhausting retries, the error propagates to cryptofinalizerequest. The crypto API's completion wrapper treats -EBU...

CVE-2026-97585 afs: Fix double-unmap of directory block

In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afseditdirremove to use a cleanup function to unmap the block pointed to by afsdiriter::block if it's left pointing to something rather than manually kunmapping the blocks. Manually...

CVE-2026-97585

In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afseditdirremove to use a cleanup function to unmap the block pointed to by afsdiriter::block if it's left pointing to something rather than manually kunmapping the blocks. Manually...

CVE-2026-97549

The Linux kernel XFS filesystem experienced an issue where the system would under-reserve blocks during the repair of shortform (sf) directories . The root cause was an incorrect assignment of the args->total value in xrep_dir_swap_prep, which failed to account for the correct ratio between di...

CVE-2026-92746

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92746 Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it...