UBUNTU-CVE-2026-89476

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89539

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...

CVE-2026-68526

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

CVE-2026-89754 mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walkpmdrange If -pmdentry sets walk-action = ACTIONAGAIN, the pmdnone check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-installpte is not...

CVE-2026-89754

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walkpmdrange If -pmdentry sets walk-action = ACTIONAGAIN, the pmdnone check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-installpte is not...

EUVD-2026-76382

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89476 sctp: fix stream->outcnt underflow on duplicate RECONF responses

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89476 sctp: fix stream->outcnt underflow on duplicate RECONF responses

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-89476

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

CVE-2026-68526

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

CVE-2026-68526

Concrete CMS before 9.5.3 is affected by a missing anti-CSRF token validation in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php), specifically in its submit() action. The action only checked canAccess() and the per-resource canAddCalendarEvent() pe...

CVE-2026-68526 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

PT-2026-96405

In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff t underflow in cifs remap file range when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = src inode-i size - off; If off i size, this is a negative loff t, corrupting the ByteCount i...

PT-2026-90255

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gssx dec option array function fails to properly handle duplicate CREDS VALUE options in a wire-supplied option array. When multiple CRE...

PT-2026-90192

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP Stream Control Transmission Protocol implementation where a cached RECONF chunk containing multiple request parameters can lead to an underflow of the outcnt...

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

ImpactThe only authorization gate on the duplicate flow is PageAdmin.hasaddpermission,which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “maythis user create a page at all”. Nothing checks the user’s relationship to the page beingcopied:- cms/admin/forms.py —...

PYSEC-2026-3821 django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

Improper Enforcement of a Single, Unique Action

Overview pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP Affected versions of this package are vulnerable to Improper Enforcement of a Single, Unique Action in the handling of ResourcePackClientResponsePacket packets wit...

CVE-2026-86744

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86198

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...