CVE-2026-97481

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix possible ISR soft lockup There are rare cases in which the host gets stuck in the ISR because it is flooded with messages during the startup phase. The reason for the soft lockup in the ISR is the missing FIFO...

CVE-2026-93222

In the Linux kernel, the following vulnerability has been resolved: signal: avoid shared siginfo namespace rewrites sendsignallocked rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it...

CVE-2026-93225

In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95usbphygettca succeeds, the typec switch leaks because the only cleanup path was in .remove, which never runs on probe failure. Use...

CVE-2026-97512: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM The runtime PM functions had incomplete error handling that could leave the system in an inconsistent state. If any operation failed midway through suspend or resume...

CVE-2026-97508: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb-rootswitch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tbxdphandlerequest return error to the remote host. However, we need to make sure we keep the uui...

CVE-2026-97436: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: rework FDB management on the bridge leave path On bridge leave, the dpaa2switchportsetfdb function always allocates a new FDB for the port which is becoming standalone. In case no FDB is found, then the port leaving...

CVE-2026-97426: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parse error before acquiring PM access...

CVE-2026-93284: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drmpagemapmigrateunmappages relies on the pages array to determine which pages require DMA unmapping. However, drmpagemapmigrationunlockputpages clears the array as pa...

CVE-2026-91132: Origin Validation Error

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

CVE-2026-93225: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95usbphygettca succeeds, the typec switch leaks because the only cleanup path was in .remove, which never runs on probe failure. Use...

CVE-2026-93222: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: signal: avoid shared siginfo namespace rewrites sendsignallocked rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it...

CVE-2026-85682: Origin Validation Error

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-97176: Missing Authorization

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...

CVE-2026-97155: Origin Validation Error

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empt...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124469)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124469 advisory. When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content...

The vulnerability of the ImageIO component in the Oracle Java SE software platform, as well as in Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows attackers to gain unauthorized access to protected information.

The vulnerability of the ImageIO component in the Oracle Java SE software platform, as well as in Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...

The vulnerability of the JSE component of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows attackers to trigger a service failure.

The vulnerability of the JSE component of Oracle Java SE software, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

The vulnerability of the JSE component of Oracle Java SE software, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows attackers to gain unauthorized access to protected information.

The vulnerability of the JSE component of Oracle Java SE software, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized...

The vulnerability of the 2D software platform Oracle Java SE, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows a attacker to trigger a service failure.

The vulnerability of the Oracle Java SE 2D software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker to cause service interruptions...

The vulnerability of the Security component of Oracle Java SE software, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Security component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker operating remotely to gain...