CVE-2026-63768: URL Redirection to Untrusted Site

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

MAL-2026-10931 Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

CVE-2026-63839 platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmidevevaluateint lwmidevevaluateint leaks output.pointer when retval == NULL found by sashiko.dev 1. Fix it by moving retobj = output.pointer' outside of the if retval' block...

CVE-2026-63797

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsgchrdevprobe stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsgchrdeveptdevadd. If rpmsgchrdeveptdevadd then fails, its error path...

CVE-2026-63821

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

CVE-2026-63821 wifi: rtw88: usb: fix memory leaks on USB write failures

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

CVE-2026-63803 hdlc_ppp: sync per-proto timers before freeing hdlc state

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...

CVE-2026-63803 hdlc_ppp: sync per-proto timers before freeing hdlc state

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...

CVE-2026-63803

The CVE-2026-63803 has concrete technical details in the Linux kernel: hdlc_ppp timers for PPP LCP/IPCP/IPV6CP in struct ppp are not synchronized on teardown due to a missing .detach callback, causing a use-after-free when a ppp_timer dereferences freed memory. The fix adds a detach helper that c...

EUVD-2026-45463

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsgchrdevprobe stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsgchrdeveptdevadd. If rpmsgchrdeveptdevadd then fails, its error path...

CVE-2026-63903: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkinsa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from...

PT-2026-61156

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the lwmi dev evaluate int function within the platform/x86: lenovo-wmi-helpers module. The issue arises when the retval variable is NULL, causing the output.point...

PT-2026-61119

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the HDLC PPP protocol implementation. The struct ppp allocated as hdlc-state registers timers for PPP control protocols LCP, IPCP, and IPV6CP using timer...

CVE-2026-16016 poco-ai poco-claw task.py run_task server-side request forgery

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function runtask of the file executor/app/api/v1/task.py. The manipulation of the argument callbackurl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is...

CVE-2026-16016

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function runtask of the file executor/app/api/v1/task.py. The manipulation of the argument callbackurl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is...

EUVD-2026-45172

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function runtask of the file executor/app/api/v1/task.py. The manipulation of the argument callbackurl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is...

CVE-2026-16016 poco-ai poco-claw task.py run_task server-side request forgery

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function runtask of the file executor/app/api/v1/task.py. The manipulation of the argument callbackurl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is...

CVE-2026-11575

The PhonePe Payment Solutions WordPress plugin, in versions prior to 3.1.0 , is vulnerable to an unauthenticated payment bypass. The root cause is that the plugin fails to properly verify incoming payment callbacks because the secret used for signature validation is empty on sites using the curre...

EUVD-2026-45145

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...

CVE-2026-11575

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...