CVE-2026-68242

The CVE-2026-68242 entry concerns the Linux kernel's drm/i915/gt subsystem, where a NULL dereference could occur on sched_engine allocation failure due to calling intel_context_put() before intel_context_init() in execlists_create_virtual(). The issue is resolved by a fix that prevents the NULL d...

CVE-2026-68223

The CVE covers a Linux kernel fix in media: meson: vdec where vdec_open() previously skipped releasing the m2m context when vdec_init_ctrls() failed, causing a memory/resource leak. The patch adds an explicit err_m2m_ctx_release path that calls v4l2_m2m_ctx_release(sess->m2m_ctx) before releas...

EUVD-2026-55324

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: Fix memory leak in error path of vdecopen The vdecopen function previously jumped directly to errm2mrelease when vdecinitctrls failed, skipping release of the m2m context. This caused a resource leak. Fix it b...

CVE-2026-68223 media: meson: vdec: Fix memory leak in error path of vdec_open

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: Fix memory leak in error path of vdecopen The vdecopen function previously jumped directly to errm2mrelease when vdecinitctrls failed, skipping release of the m2m context. This caused a resource leak. Fix it b...

CVE-2026-68087

CVE-2026-68087 affects the Linux kernel HID wacom driver. The vulnerability stems from using GFP_KERNEL inside wacom_wac_queue_flush(), which is invoked from the atomic-context, URB-completion path (hid_irq_in()) via wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush. Using GF...

EUVD-2026-55268

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...

CVE-2026-68087 HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...

EUVD-2026-54995

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-48158: Embedded Malicious Code

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlle...

CVE-2026-68223: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: Fix memory leak in error path of vdecopen The vdecopen function previously jumped directly to errm2mrelease when vdecinitctrls failed, skipping release of the m2m context. This caused a resource leak. Fix it b...

PT-2026-69623

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak occurs in the Linux kernel within the meson vdec component. The vdec open function fails to release the m2m context when the vdec init ctrls function fails, as it jumps...

PT-2026-69488

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A scheduling while atomic bug exists in the Linux kernel. The function wacom wac queue flush is called through the .raw event callback sequence wacom raw event → wacom wac pen serial...

PT-2026-69347

Name of the Vulnerable Software and Affected Versions s2Member WordPress plugin versions prior to 260805 Description The plugin fails to escape several shortcode attributes before they are output within an inline script context. This allows users with contributor-level access to perform a stored...

PT-2026-69878

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated member with backup-restore permissions can execute arbitrary operating-system commands in the host context via execAsync or execAsyncRemote. This occurs because the...

PT-2026-69857

Name of the Vulnerable Software and Affected Versions use-context-selector affected versions not specified Description Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits that executed remote attacker-controlled code on developer machines during npm...

RHEL 9 : xorg-x11-server-Xwayland (RHSA-2026:52398)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:52398 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer...

CVE-2026-72865: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c,...

PT-2026-69644

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/i915/gem component where a memory leak occurs during proto context error handling. Specifically, after a successful BALANCE/PARALLEL SUBMIT extension during...

PT-2026-69642

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference occurs in the IOCTL path when a sched engine allocation fails. This happens because intel context put is called before intel context init within the execlists create...

PT-2026-69643

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the drm/i915/gem component. This happens when a context engine slot N is set to I915 ENGINE CLASS INVALID or I915 ENGINE CLASS INVALID NONE, and an...