CVE-2026-90075 net/sched: fq_codel: clamp default quantum and mtu

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqcodel: clamp default quantum and mtu fqcodelinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return 0x80000000...

PT-2026-94180

Name of the Vulnerable Software and Affected Versions Master Addons for Elementor versions prior to 3.1.9 Description The plugin fails to perform an authorization check on the AJAX action used to deactivate Popup Builder popups. It relies solely on a nonce a number used once to prevent replay...

PT-2026-94619

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the arm mpam module when a user unbinds a Memory System Component MSC after an error interrupt has triggered the mpam disable function. This happens...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a DBADM privileged user under certain conditions (CVE-2026-87958)

Summary IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a database administration authority DBADM privileged user under certain conditions CVE-2026-87958 Vulnerability Details CVEID:CVE-2026-87958 DESCRIPTION: IBM Db2 11.5.0 through...

DEBIAN-CVE-2026-90028

In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulatorisenabled reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can ski...

CVE-2026-90028

In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulatorisenabled reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can ski...

CVE-2026-90028 usb: typec: hd3ss3220: track VBUS enable state per consumer

In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulatorisenabled reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can ski...

CVE-2026-90028

CVE-2026-90028 affects the Linux kernel USB Type-C driver for the hd3ss3220 controller. The root cause is that regulator_is_enabled() reports the aggregate regulator state rather than whether this particular consumer holds an enable reference. When another consumer enables VBUS first, the driver ...

CVE-2026-90028 usb: typec: hd3ss3220: track VBUS enable state per consumer

In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulatorisenabled reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can ski...

CVE-2026-73450

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these...

CVE-2026-73450 Security Advisory 0161

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these...

EUVD-2026-80083

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these...

CVE-2026-73450

On affected Arista EOS platforms with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the heartbeat network segment can send crafted UDP packets to corrupt the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary sw...

CVE-2026-90028: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulatorisenabled reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can ski...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38586)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the guestwifisync function. Attackers can exploit this vulnerability by sending a specially crafted MQTT...

Linux Distros Unpatched Vulnerability : CVE-2026-90028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: hd3ss3220: track VBUS enable state per consumer regulatorisenabled reports the aggregate regulator state, not whether this consumer holds an enable...

PT-2026-93259

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description An unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state of platforms running Arist...

PT-2026-93510

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iris vpu power off function where the use of disable irq nosync fails to wait for queued threaded IRQ handlers to complete before returning. This can lead to a...

EUVD-2026-77758

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-57127 praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...