Linux Distros Unpatched Vulnerability : CVE-2026-98710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release...

CVE-2026-98750: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

PT-2026-116876

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio device left registered on PM setup failure pm runtime set active failing in probe jumps to error unreg buffer, which only calls iio triggered buffer cleanup -- it does not undo the iio device...

PT-2026-117001

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix ovl adaptor platform device leak mtk drm probe creates an OVL adaptor platform device with platform device register data when the display pipeline requires the OVL adaptor. If a later initialization step fails,...

PT-2026-117052

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call get device with the master MTD get mtd device calls the master's get device callback with mtd, which may be a partition. put mtd device passes the master. This breaks gluebi partitions because gluebi get device us...

PT-2026-117026

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5 module where the mlx5 handle changeupper event and mlx5 handle changeinfodata event functions incorrectly call bonding-specific APIs when handling team...

Linux Distros Unpatched Vulnerability : CVE-2026-98779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and...

CVE-2026-98710: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.12 has a security vulnerability. This vulnerability arises from the failure to reset the saved termios state during device registration. Additionally, some TTY drivers do not ensure that the next device number is no longer used. When the TTY is closed and termios is...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the fact that the EEPROM data allocated by calling ileeprominit after successful device detection is not released when the PCI device is removed. This leads to a memory leak...

CVE-2026-30971 ZoneMinder: Authenticated RCE via command injection in monitor Device Path

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

CVE-2026-30971 ZoneMinder: Authenticated RCE via command injection in monitor Device Path

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

CVE-2026-30971

ZoneMinder, an open-source CCTV software application, is vulnerable to Remote Code Execution (RCE) via command injection in versions prior to 1.39.2, 1.38.2, and 1.36.40. The root cause is the interpolation of an unvalidated monitor Device field into shell commands within PHP and Perl control pat...

CVE-2026-111654

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to rea...

CVE-2026-111623

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...

CVE-2026-111654

Versions of FastBee through 2.1.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the /iot/group By-ID endpoints. The root cause is that GroupController queries fail to perform necessary owner checks , allowing authenticated low-privilege users—including self-reg...

CVE-2026-111654 FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to rea...

EUVD-2026-103076

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to rea...

CVE-2026-111654 FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to rea...

CVE-2026-111623

The Xiaozhi-esp32-server-java software (versions through 6.1.0 ) is vulnerable to an authentication bypass (CWE-290) in the OTA endpoint . An unauthenticated attacker can obtain valid device WebSocket tokens by requesting /api/device/ota using any arbitrary MAC address. Successful exploitation al...