CVE-2026-89991 bpf: Fix infinite loop in pcpu_freelist push with one possible CPU

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...

CVE-2026-89877 media: saa7164: fix cleanup on resource allocation failure

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources fails, saa7164devsetup decrements the device...

CVE-2026-89877 media: saa7164: fix cleanup on resource allocation failure

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources fails, saa7164devsetup decrements the device...

CVE-2026-85641

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

EUVD-2026-80199

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-83268

creationtimestamp| type| source ---|---|--- 2026-09-16 01:40:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlyznq5cq2j 2026-09-16 02:12:39+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvm2ttfl4i24 2026-09-16 16:00:43+00:00| seen|...

CVE-2026-83059

creationtimestamp| type| source ---|---|--- 2026-09-16 00:11:33+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlu3bm2in2t 2026-09-16 00:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlwa6ujet2t 2026-09-16 16:00:45+00:00| seen|...

Linux Distros Unpatched Vulnerability : CVE-2026-89877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory...

CVE-2026-19667: Numeric Truncation Error

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

CVE-2026-19667: Numeric Truncation Error

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

CVE-2026-89877: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources fails, saa7164devsetup decrements the device...

PT-2026-93486

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference occurs in the qla2x00 error entry function due to a double-read of ha-req q mapque. The function reads the map slot once for a NULL check and a second time when...

Linux Distros Unpatched Vulnerability : CVE-2026-89991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters...

Linux Distros Unpatched Vulnerability : CVE-2026-19667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry...

CVE-2026-18120: Missing Authorization

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier...

PT-2026-93490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qla2xxx driver where the qla2x00 status entry function fails to properly validate SCSI Request Blocks SRB before they enter the SCSI fast path. The function filter...

CVE-2026-19886

creationtimestamp| type| source ---|---|--- 2026-09-15 20:13:28+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvlgrkta4a2i...

CVE-2026-90969

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...

CVE-2026-68534

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...