PT-2026-122433

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table. Patches This has been fixed in pypdf==6.21.2. Workarounds If you cannot upgrade yet, consider applying the changes from PR 423...

UBUNTU-CVE-2026-55862

pupnp is an SDK for development of UPnP device and control point appli...

UBUNTU-CVE-2026-114038

A flaw was found in device-mapper-multipath. A local user can trigger...

PT-2026-122244

Name of the Vulnerable Software and Affected Versions Postiz affected versions not specified Description Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper...

PT-2026-122458

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

PT-2026-122221

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An unauthenticated remote peer can cause memory exhaustion leading to a denial of service. The issue occurs in the twisted.conch.telnet.Telnet.dataReceived function, which appends bytes received...

PT-2026-121962

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot root path pivot root reads the parents of new root and of the caller's root and checks whether they are shared before it checks that either mount is in the caller'...

PT-2026-121960

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch task namespaces and copy namespaces and dropped...

PT-2026-122088

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA NA or IA PD option whose body is shorter than struct dhcpv6 ia hdr, casts the option header to that full structure, and reads...

PT-2026-121892

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folio queue ENOMEM in writeback by adding a mempool" added a mempool for the folio queues and made the request, subrequest and folio...

PT-2026-121978

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe i2c notifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xe i2c client work then...

PT-2026-122087

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message first lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network...

CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat a...

PT-2026-121890

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon ptep mkold damon va prepare access check picks a random byte address within the region and stores it in r-sampling addr. damon va mkold passes it into a page table walk,...

PT-2026-121891

In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust idledly against divide-by-zero and overflow adjust idledly has several corner-case issues flagged during review: 1. If xe gt clock init failed to recognise the crystal clock, gt-info.timestamp base is 0, whi...

PT-2026-122415

Summary /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which...

PT-2026-122421

Summary The Postgres and SQLite stores save a namespace as its labels joined with ., so "tenant", "bob" and "tenant.bob", map to the same stored namespace. put rejected labels containing ., but get, search, delete, list namespaces, their async versions, and ops passed directly to batch/abatch did...

PT-2026-122239

Name of the Vulnerable Software and Affected Versions happy-dom versions 17.0.0 through 21.0.3 Description The ESM compiler in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts fails to validate named ESM import aliases before inserting them into generated destructuring bindings. When...

PT-2026-122459

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

PT-2026-122225

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a...