CVE-2026-27131

The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other...

The vulnerability of the __lf_x_usb_enable_rx() function in the drivers/net/wireless/purelifi/plfxlc/usb.c module of the Linux kernel adapter driver allows a hacker to cause a service failure.

The vulnerability of the lfxusbenablerx function in the drivers/net/wireless/purelifi/plfxlc/usb.c module of the Linux kernel’s wireless adapter driver relates to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-30975 Sonarr Authentication Bypass vulnerability

Sonarr is a PVR for Usenet and BitTorrent users. Versions prior to 4.0.16.2942 have an authentication bypass that affected users that had disabled authentication for local addresses Authentication Required set to: Disabled for Local Addresses without a reverse proxy running in front of Sonarr tha...

SUSE CVE-2026-23287

In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLIC ignores interrupt completion message for disabled interrupt, explained by the specification: The PLIC signals it has completed executing an interrupt handler ...

EUVD-2026-15215

In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLIC ignores interrupt completion message for disabled interrupt, explained by the specification: The PLIC signals it has completed executing an interrupt handler ...

CVE-2026-23287

In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLIC ignores interrupt completion message for disabled interrupt, explained by the specification: The PLIC signals it has completed executing an interrupt handler ...

UBUNTU-CVE-2026-23287

In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLIC ignores interrupt completion message for disabled interrupt, explained by the specification: The PLIC signals it has completed executing an interrupt handler ...

CVE-2026-23287 irqchip/sifive-plic: Fix frozen interrupt due to affinity setting

In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLIC ignores interrupt completion message for disabled interrupt, explained by the specification: The PLIC signals it has completed executing an interrupt handler ...

CVE-2026-23287

The CVE-2026-23287 issue affects the Linux kernel’s PLIC interrupt handling for SiFive irqchip, where a race between affinity changes and interrupt enable bits could freeze an interrupt. Root cause: completion handling could ignore or mis-handle an interrupt if the hart affinity change left the e...

CVE-2026-23287 irqchip/sifive-plic: Fix frozen interrupt due to affinity setting

In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLIC ignores interrupt completion message for disabled interrupt, explained by the specification: The PLIC signals it has completed executing an interrupt handler ...

PT-2026-28129

Name of the Vulnerable Software and Affected Versions Sonarr versions prior to 4.0.16.2942 Description Sonarr is a PVR for Usenet and BitTorrent users. A flaw exists where authentication could be bypassed in versions with authentication disabled for local addresses Authentication Required set to:...

CVE-2026-27131

The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other...

CVE-2026-27131 Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground

The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other...

PT-2026-27177

The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other...

DEBIAN-CVE-2026-33550

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length only 12 digits instead of the 20 recommended...

CVE-2026-33550

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length only 12 digits instead of the 20 recommended...

PT-2026-26962

Name of the Vulnerable Software and Affected Versions SOGo versions prior to 5.12.5 Description SOGo does not properly renew One-Time Passwords OTPs when a user disables and re-enables them. Additionally, the generated OTPs have a length of only 12 digits, which is shorter than the recommended 20...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the wcHpkeLabeledExtract function when processing an oversized ECH configuration. An attacker can cause a client crash or achieve remote code execution by sending a maliciously crafted ECH config from a TLS server...

PT-2026-36469

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the mac80211 subsystem, the ieee80211 tdls oper function fails to verify if a station is a TDLS Tunneled Direct Link Setup station when NL80211 TDLS ENABLE LINK is called. The system...

EUVD-2026-11621

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enableechoserver function. This vulnerability allows attackers to execute arbitrary commands via a crafted input...