CVE-2026-90402 bus: mhi: host: Fix controller cleanup on EDL sysfs failure

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix controller cleanup on EDL sysfs failure mhiregistercontroller adds the controller device before creating the optional triggeredl sysfs file. If sysfscreatefile fails, the error path only drops the device...

CVE-2026-90330 HID: logitech-hidpp: Fix FF device cleanup on init failure

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix FF device cleanup on init failure hidppffinit creates the input force-feedback device with inputffcreate, then allocates the HID++ FF private data, effect ID array, and workqueue. If any of those...

CVE-2026-90147

This Linux kernel vulnerability affects the devres clock subsystem, specifically the function devm_clk_get_optional_enabled_with_rate() . The root cause is an ordering bug: the cleanup action is registered before the clock rate is set. If setting the rate fails, the deferred cleanup attempts to d...

CVE-2026-90147 clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()

In the Linux kernel, the following vulnerability has been resolved: clk: devres: fix cleanup in devmclkgetoptionalenabledwithrate devmclkgetoptionalenabledwithrate registers its cleanup action before setting the clock rate. If setting the rate fails, it attempts to disable and unprepare a clock...

EUVD-2026-81740

In the Linux kernel, the following vulnerability has been resolved: clk: devres: fix cleanup in devmclkgetoptionalenabledwithrate devmclkgetoptionalenabledwithrate registers its cleanup action before setting the clock rate. If setting the rate fails, it attempts to disable and unprepare a clock...

CVE-2026-90147 clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()

In the Linux kernel, the following vulnerability has been resolved: clk: devres: fix cleanup in devmclkgetoptionalenabledwithrate devmclkgetoptionalenabledwithrate registers its cleanup action before setting the clock rate. If setting the rate fails, it attempts to disable and unprepare a clock...

CVE-2026-66571

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

CVE-2026-66571 WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

CVE-2026-66571

An unauthenticated Cross Site Request Forgery (CSRF) vulnerability exists in the WordPress plugin Asset CleanUp: Page Speed Booster in versions ≤ 1.4.0.5 , as discovered by Helder Gonçalves and tracked by Patchstack. The CVSS 3.1 score is 7.1 (High) with a Changed Scope, indicating that a success...

CVE-2026-66571 WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

EUVD-2026-81492

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Helder Gonçalves in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.4.0.5...

unbound: Unbound: Denial of Service via use-after-free in DoH stream cleanup

A use-after-free vulnerability in Unbound's DNS-over-HTTPS DoH stream cleanup code allows a remote attacker to cause a denial of service DoS. When DoH support is compiled, sending a specially crafted DoH connection under specific failure conditions—such as an RPZ drop query or heavy traffic—cause...

CVE-2026-66571: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

CVE-2026-93069: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix cleanup ordering Commit 173e02d67494 "OPP: Initialize scope-based pointers inline" added initialization for all pointers. In some cases, the ordering was changed so that opptable was initialized after opp. This also...

CVE-2026-93185: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt700-sdw: always drain jack work on remove rt700sdwremove drains jackdetectwork and jackbtncheckwork only when rt700-hwinit is true. That state bit is cleared by rt700updatestatus when the SoundWire slave becomes UNATTACHE...

PT-2026-94440

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the Bluetooth L2CAP implementation. The problem occurs because a new socket may be added to the parent socket accept queue after the l2cap sock clean...

tomcat: Apache Tomcat: Denial of Service via malformed HTTP/2 request

A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability allows a remote attacker to send a malformed HTTP/2 request. This can potentially cause a denial of service, leading to one request from another user failing...

EUVD-2026-80576

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosuioctlsubmitjob allocates donefence before validating buffer handles. Errors after allocation call ethosujoberrcleanup, which frees the job but leaks the uninitialized fence. A...

CVE-2026-89976 accel/ethosu: fix job completion fence cleanup

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosuioctlsubmitjob allocates donefence before validating buffer handles. Errors after allocation call ethosujoberrcleanup, which frees the job but leaks the uninitialized fence. A...