CVE-2026-66412

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-66412 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-64235

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIGCALLDEPTHTRACKING enabled on an x86 retbleed-affected platform eg: Skylake, with retbleed=stuff, registering a dynamic ftrace trampoline crashes on...

PT-2026-64852

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.6.3 Description Authenticated users can access milestone data from projects to which they are not assigned. This is possible by providing arbitrary integer milestone IDs to the 'tickets.getMilestone' JSON-RPC...

UBUNTU-CVE-2026-64208

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

smb: client: fix double-free in SMB2_ioctl() replay

...

mcpsnoop v0.15.0

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...

SUSE CVE-2026-64526

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnlopscomplete tsconfigpreparedata calls ethnlopsbegin, we need to call ethnlopscomplete before returning the error...

CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

UBUNTU-CVE-2026-64509

In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after blkmqallocdisk, but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later...

CVE-2026-64526

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnlopscomplete tsconfigpreparedata calls ethnlopsbegin, we need to call ethnlopscomplete before returning the error...

CVE-2026-64510

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpinfitinit error cleanup If acpinfitinit fails after adding the acpidesc object to the acpidescs list, that object is never removed from that list because the acpinfitshutdown devm action is not added for...

CVE-2026-64508 bpf: Support for hardening against JIT spraying

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64415 mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup

In the Linux kernel, the following vulnerability has been resolved: mm/swap: add condresched in swapreclaimfullclusters to prevent softlockup We hit a real softlockup in an internal stress test environment. The workload was LTP memory/swap stress on a large arm64 machine, with 320 CPUs, about 1TB...

CVE-2026-64377 cpufreq: qcom-cpufreq-hw: Fix possible double free

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

CVE-2026-64280 fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afudmamapregion afuioctldmamap accepts a 64-bit length from userspace via DFLFPGAPORTDMAMAP ioctl without an upper bound check. The value is passed to afudmapinpages where npages is...

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting

...

PT-2026-64570

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dwc3 ulpi setup function where it incorrectly passes dwc3-regs to the dwc3 readl and dwc3 writel functions. These functions are designed to take the dwc3 structure...

PT-2026-64757

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethtool component where the tsconfig prepare data function calls ethnl ops begin but fails to call ethnl ops complete before returning an error. Recommendations At...

PT-2026-64729

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF JIT allocator where multiple small programs are packed into larger executable allocations and space is reused as programs are loaded and freed. When new code i...