PT-2026-122088

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA NA or IA PD option whose body is shorter than struct dhcpv6 ia hdr, casts the option header to that full structure, and reads...

PT-2026-122144

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user the one that executes Isar instead of root. If...

PT-2026-122124

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force...

PT-2026-122125

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy...

PT-2026-122214

The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier iface-config.dhcpv4.xid as a counter rather than as a per-transaction random value. It was seeded once with sys rand32 get in dhcpv4 start internal, incremented by one in dhcpv4 send discover and dhcpv4 send...

PT-2026-122215

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dns resolve init locked - register dispatcher - dns dispatcher register, with the local port left at 0 so the stack picks an ephemeral port exactly once. dns...

PT-2026-122216

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device next/class/bt hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt hci tx sync in allocated that buffer from bt hci ep pool, a fixed pool whose slots...

PT-2026-121910

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request irq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

PT-2026-122050

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inet dump fib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fib dump info fnhe uses fib info num pat...

PT-2026-122042

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee active cpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the...

PT-2026-122037

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

PT-2026-121836

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

PT-2026-121837

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source id. Attackers can call the conversations create endpoint with another account's source id to create or retrieve...

PT-2026-122232

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who ca...

PT-2026-122122

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with auth.jwtSecret configured and a 2026-07-28-era client declaring elicitation.form support, a dispatch-gated tool call offered an inputRequired...

PT-2026-122123

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, create entity, link entities, rename entity, unlink entities and delete entity regenerate memory notes from SQLite at the computed memory//.md path without reliably preserving note...

PT-2026-122442

Summary create entity, link entities, rename entity, unlink entities and delete entity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...

PT-2026-122244

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads...

PT-2026-122239

Name of the Vulnerable Software and Affected Versions happy-dom versions 17.0.0 through 21.0.3 Description The ESM compiler in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts fails to validate named ESM import aliases before inserting them into generated destructuring bindings. When...

PT-2026-122126

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint /tasks/download/monitor.socket in goobi-viewer-core accepts download requests from unauthenticated users...