UBUNTU-CVE-2026-88016

rclone is a command-line program to sync files and directories to and...

PT-2026-90425

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc ops dispatch nlmsvc ops is published by nfsd lockd init and cleared by nfsd lockd shutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The...

PT-2026-90324

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs parse packet set receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGE SIZE - 8. For version 1 headers the packet set starts...

PT-2026-90256

In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp lock before publishing proc entry create use gss proxy proc entry publishes /proc/net/rpc/use-gss-proxy via proc create data before init gssp clnt runs mutex init on sn-gssp lock. Once the dentry is linked under...

UBUNTU-CVE-2026-88015

rclone is a command-line program to sync files and directories to and...

PT-2026-90296

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf get stack get perf callchain returns a per-CPU perf callchain entry buffer and releases its recursion slot via put callchain entry before returning, so nothing keeps the entry reserved while bpf get...

PT-2026-90381

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdr decode sattr: iap-ia atime.tv nsec = tmp2 NSEC PER USEC; tmp2 is a u32 and NSEC PER USEC is...

PT-2026-90439

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs direct propagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfs direct propagate during testing. Analysis revealed that after truncating a...

PT-2026-90452

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u audio: Fix use-after-free on sound card disconnect g audio cleanup invokes snd card free when closed to initiate sound card teardown and immediately frees the underlying struct snd uac chip context. However, snd ca...

PT-2026-89908

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

PT-2026-90176

In the Linux kernel, the following vulnerability has been resolved: s390/cpum cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu cf events at first event...

PT-2026-90429

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd setattr checks whether a size update needs NFSD MAY TRUNC before it takes inode lock. The comparison uses the file size sampled by that unlocked read, but the actual ATTR SIZE...

nginx security update

1.20.1-28.0.1.el98.6 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 - Update upstream references Orabug: 36579090 2:1.20.1-28.6 - Resolves: RHEL-212458 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533...

PT-2026-90533

🚨Critical - mysql-mcp-server Unauth SQL Execution via Insecure SSE Transport CVE-2026-59971 In mysql-mcp-server SSE/HTTP mode, SseServerTransport is created without security settings, leaving the Starlette app without CORS/TrustedHost protections and no auth DNS-rebinding protection disabled...

PT-2026-90237

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick task releasing the rq lock Core scheduling's pick next task breaks when a -pick task implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

The vulnerability of the decodeSliceUnit_WPP() function in the libde265/decctx.cc file of the h.265 video codec implementation by Libde265, which allows a attacker to cause a service failure.

The vulnerability of the decodeSliceUnitWPP function in the libde265/decctx.cc file of the h.265 codec implementation, developed by Libde265, is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause...

ROS-20260911-73-0132

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created video file...

ROS-20260911-73-0142

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to errors in HTTP requests processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions using a malicious file...

PT-2026-90498

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22_ 10.0 < 10.10_ 11.0 < 11.3 - RCE

!/usr/bin/env python3 Exploit Title: ILIAS save$this-filename - fileputcontents$filename, jsonencode$cookies. Attacker-chosen path + JSON-embedded PHP = webshell. Tested: ILIAS 10.9 on Rocky Linux 9 Apache + PHP-FPM 8.2, MariaDB bac...