CVE-2026-54258

ZoneMinder , a free open-source closed-circuit television (CCTV) application, is affected by an authorization bypass in direct event media endpoints. In versions prior to 1.36.39 , 1.38.4 , and 1.39.11 , an authenticated low-privileged user holding only coarse Events=View and/or Snapshots=View pe...

CVE-2026-68535

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-49439

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue...

CVE-2026-49439

OpenRemote (open-source IoT platform) has a missing authorization flaw in its predicted datapoint write endpoint (PUT /api/{realm}/asset/predicted/{assetId}/{attributeName}). The implementation checks READ_ASSETS instead of requiring write:assets before calling assetPredictedDatapointService.upda...

EUVD-2026-76694

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue...

DEBIAN-CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

UBUNTU-CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

CVE-2026-89479

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

DEBIAN-CVE-2026-89479

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

AZL-100410 CVE-2026-89479 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

UBUNTU-CVE-2026-89479

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

CVE-2026-89479

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A packet...

EUVD-2026-76688

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-68535

Concrete CMS versions 9.2.0 through 9.5.2 are affected by a missing authorization check in the Area REST API block-create endpoint. The endpoint failed to invoke the block type controller's validate() method, which is responsible for authorizing referenced files against the user's file-manager vi...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-89739

CVE-2026-89739 is a use-after-free in the Linux kernel 's USB DWC3 gadget driver. When a USB gadget is removed, dwc3_gadget_free_endpoints frees endpoint memory via kfree(dep), but a delayed work (dwc3_nostream_work) previously queued on system_percpu_wq during a DEPEVT_STREAM_NOSTREAM event may ...

CVE-2026-89739 usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...