CVE-2026-68466 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. A timed out DMA transfer is therefore unmapped and reported as successfu...

CVE-2026-68466

The CVE concerns the Linux kernel driver path mtd: rawnand: lpc32xx_slc. lpc32xx_xmit_dma() waits for a DMA completion callback but uses wait_for_completion_timeout() and can time out, causing a DMA transfer to be unmapped and reported as successful to the NAND read/write path. The fix is to retu...

EUVD-2026-59088

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. A timed out DMA transfer is therefore unmapped and reported as successfu...

Linux Distros Unpatched Vulnerability : CVE-2026-72494

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit requestdone flag, but without proper barrie...

PT-2026-73010

In the Linux kernel, the following vulnerability has been resolved: xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past...

PT-2026-72661

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rl kref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdma req could return to its fr...

PT-2026-72682

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit request done flag, but without proper barriers around request done. An earlier patch by Gui-Dong Han attempted t...

PT-2026-73012

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xsk drop skb for AF XDP multi-buffer Tx This patch is inspired by the check1 from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the who...

PT-2026-72409

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When wait for completion interruptible timeout in svc tcp handshake returns 0 timeout or -ERESTARTSYS signal and tls handshake cancel then returns false,...

PT-2026-72322

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devm request irq The driver calls devm request irq before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after devm...

CVE-2026-59714

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-59714

CVE-2026-59714 describes a cross-channel message overwrite vulnerability in Open WebUI exposed by the chat-completions path. From v0.9.5 to before v0.10.0, an authenticated user could overwrite a message in a channel they do not belong to by using a channel: chat_id with a caller-supplied message...

CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-73559 vLLM: Completion prompt lists fan out into unbounded engine requests

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded liststr or listlistint, prompttoseq in vllm/renderers/inputs/preprocess.py and...

openSUSE 16 Security Update : zk (openSUSE-SU-2026:21567-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21567-1 advisory. Changes in zk: - Update to version 0.15.6: Parse links to notes in frontmatter Set filters for lsp completion items from the config Set a note's...

CVE-2026-16621

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

EUVD-2026-57173

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

CVE-2026-16621 Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

CVE-2026-16621

The Payment Gateway for PayPal on WooCommerce WordPress plugin (pre-9.2.1) is vulnerable to an unauthenticated payment bypass in its PayPal return handler. The issue stems from not verifying that payments actually succeeded before completing an order: attacker-controlled parameters are read, ther...