wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler

...

CVE-2026-68353

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx without validation against the buffer length. This allows...

CVE-2026-68237

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset prereset only force-completes fences of MAPPED queues. A queue in any other state e.g. mid-eviction keeps its lastfence pending; after a GPU reset that fence never...

CVE-2026-68353 wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx without validation against the buffer length. This allows...

CVE-2026-68353

Summary: CVE-2026-68353 affects the Linux kernel’s wifi/ath6kl driver. The firmware-provided 8-bit num_msg value drives a loop in ath6kl_wmi_tx_complete_event_rx() without validating against the WMI buffer length, allowing out-of-bounds reads up to 1020 bytes past the event buffer when the firmwa...

EUVD-2026-55454

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx without validation against the buffer length. This allows...

CVE-2026-68340

The CVE-2026-68340 entry concerns the Linux kernel hwmon OCC poll response parser. The root cause is using a static backing-array capacity as the boundary for sensor data blocks, rather than the actual data_length, which can allow a truncated transport response to cause the parser to read beyond ...

CVE-2026-68237

CVE-2026-68237 resolves an indefinite fence wait in drm/amdgpu/userq during a GPU reset. The pre_reset path only force-completes fences of MAPPED queues, leaving fences for queues in states like mid-eviction pending; after a reset, those fences may never signal, causing eviction/suspend workers a...

CVE-2026-68237 drm/amdgpu/userq: fix indefinite fence wait during GPU reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset prereset only force-completes fences of MAPPED queues. A queue in any other state e.g. mid-eviction keeps its lastfence pending; after a GPU reset that fence never...

CVE-2026-72689: Authorization Bypass Through User-Controlled Key

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

CVE-2026-68353: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx without validation against the buffer length. This allows...

CVE-2026-19340

A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/completebackend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possibl...

CVE-2026-19340 anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery

A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/completebackend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possibl...

CVE-2026-64601

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: captureurbcomplete: redundant usbanchorurb corrupts anchor list on each resubmission In captureurbcomplete, usbanchorurb is called on every completion callback, but the URB is already anchored from the initial...

CVE-2026-64601 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: captureurbcomplete: redundant usbanchorurb corrupts anchor list on each resubmission In captureurbcomplete, usbanchorurb is called on every completion callback, but the URB is already anchored from the initial...

PT-2026-68640

Name of the Vulnerable Software and Affected Versions Payment Gateway for Redsys & WooCommerce Lite WordPress plugin versions prior to 7.0.2 Description The plugin fails to verify the authenticity of incoming payment-provider notifications for a specific payment method before marking orders as...

Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub

Summary Multiple vulnerabilities were addressed in IBM Data Product Hub version 5.3.1 Patch 7 and 5.4.0 Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE...

EUVD-2026-53320

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a...

PT-2026-67942

Name of the Vulnerable Software and Affected Versions ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support versions prior to 1.17.5 Description An issue exists where authenticated attackers with the CRM Agent role, CRM Manager role, or WordPress administrator privileges, and the...

CVE-2026-11421: Improper Neutralization of Special Elements used in an SQL Command

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...