PT-2026-90214

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer buf on readdir copy failure On a readdir downcall, orangefs devreq write iter frees op-downcall.trailer buf with vfree when copy from iter full fails, but does not clear the pointer before got...

PT-2026-90182

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom battmgr: terminate the strings from firmware The qcom battmgr sc8280xp strcpy takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR STRING LEN bytes and leaves the destinatio...

PT-2026-90254

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss krb5 unwrap v2 sets buf-len to a logical length, which can be much smaller than head0.iov len the allocated receive-page capacity. It then calls xdr buf trim with a...

PT-2026-90483

In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end creating on the casefold-mismatch path ovl create real releases the new dentry twice when the casefold consistency check fails. The S IFDIR branch calls end creating and sets err, then falls through to the...

PT-2026-90336

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy write cmd to txdma builds an output report in qsdev-report buf, a heap buffer allocated in quickspi alloc report buf to the device-descriptor derived max report...

PT-2026-90368

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get name ceph get name copies the MDS-supplied name into the caller's NAME MAX-sized buffer with memcpyname, rinfo-dname, rinfo-dname len and then writes namerinfo-dname len = 0...

PT-2026-90144

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk store and kek store sk store and kek store strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == ' ' length--; bioscf...

PT-2026-90065

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996 mcu get eeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le3...

PT-2026-89899

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

PT-2026-90132

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp convert zc to xdp frame clones an XSK packet into an order-0 page and advertises PAGE SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb shared info and...

PT-2026-90140

In the Linux kernel, the following vulnerability has been resolved: io uring/waitid: honor task work cancellation io waitid cb may run through the fallback task work path when task work add can no longer queue work to the originating task. The fallback runs from a kworker and io uring marks such...

PT-2026-90100

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcp ioctl init allocates its response buffer with kmalloc and copies the whole buffer back to userspace: buf size = init.step0 resp size + init.step2 resp size; void resp...

openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21810-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Python vulnerabilities (USN-8744-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8744-1 advisory. It was discovered that Python's...

PT-2026-90542

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse access setting permission, without being an admin and without a...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21801-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21801-1 advisory. - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates bsc1258543....

openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21809-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21809-1 advisory. Update to version 3.21.1: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST...

CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22_ 10.0 < 10.10_ 11.0 < 11.3 - RCE

!/usr/bin/env python3 Exploit Title: ILIAS save$this-filename - fileputcontents$filename, jsonencode$cookies. Attacker-chosen path + JSON-embedded PHP = webshell. Tested: ILIAS 10.9 on Rocky Linux 9 Apache + PHP-FPM 8.2, MariaDB bac...

PT-2026-90488

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the folio clear dirty for io call in extent write cache pages with a plain folio test dirty check. Besides...

PT-2026-90307

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocket ioctl submit job releases rjob through rocket job put on allocation error paths. rocket job cleanup unconditionally calls rocket iommu domain putjob-domain, but...