PT-2026-121833

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore and nextBackup functions in the backup controller accept a file GET parameter and concatenate it directly to DIR BACKUP without calling...

PT-2026-121905

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

PT-2026-121952

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to i disk size, xmi can exchange reflink flags assumes every mapping moved and hands the reflink flag over to the other...

PT-2026-121926

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtio net hdr to skb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-network header' check before flow-dissecting GSO packets without VIRTIO NET HDR...

UBUNTU-CVE-2026-114038

A flaw was found in device-mapper-multipath. A local user can trigger...

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets DoS (cisco-sa-asr9k-tUyxcyXN)

According to its self-reported version, Cisco IOS XR is affected by a vulnerability. - A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact...

Linux Distros Unpatched Vulnerability : CVE-2026-99080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c...

CVE-2026-88041

Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer i...

Linux Distros Unpatched Vulnerability : CVE-2026-99006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during...

Linux Distros Unpatched Vulnerability : CVE-2026-98969

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a net/sched: fix potential stack infoleak in emtextdump,...

PT-2026-122244

Name of the Vulnerable Software and Affected Versions Postiz affected versions not specified Description Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper...

PT-2026-122211

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The experimental WireGuard VPN service contains a flaw in the handle transport data function within subsys/net/lib/wireguard/wg.c. When an incoming transport-data message has a receiver index...

Linux Distros Unpatched Vulnerability : CVE-2026-98975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes...

Linux Distros Unpatched Vulnerability : CVE-2026-99071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: do not warn on route notification size race Commit 680aea08e78c net: ipv4: Emit notification when fib hardware flags are changed added asynchronous route...

PT-2026-122214

The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier iface-config.dhcpv4.xid as a counter rather than as a per-transaction random value. It was seeded once with sys rand32 get in dhcpv4 start internal, incremented by one in dhcpv4 send discover and dhcpv4 send...

Linux Distros Unpatched Vulnerability : CVE-2026-99036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md...

Linux Distros Unpatched Vulnerability : CVE-2026-98950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hle...

Linux Distros Unpatched Vulnerability : CVE-2026-98983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed...

UBUNTU-CVE-2026-74049

Execution After Redirect EAR vulnerability in Apache Tomcat. This...

Linux Distros Unpatched Vulnerability : CVE-2026-99005

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work,...