PT-2026-82949

In the Linux kernel, the following vulnerability has been resolved: firmware: arm scmi: Fix OOB in scmi power name get scmi power name get does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access. Fix this by returning "unknown" for invalid...

PT-2026-82975

In the Linux kernel, the following vulnerability has been resolved: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map-sha against the metadata hash in its instructions. map-sha is calculated when BPF OBJ GET INFO BY FD is called on the frozen map. While the m...

PT-2026-82937

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use get unaligned be32 and put unaligned be32 to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory...

PT-2026-82944

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUG ON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

PT-2026-82967

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete on devcom error mlx5 mpesw work returned without calling complete when mlx5 lag get devcom comp returned NULL. A caller that queued the work and waited on mpesww-comp would block...

PT-2026-82958

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dw dp: Fix null-ptr-deref in dw dp remove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

PT-2026-83004

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get ss info from atombios uses calc pll cs-ctx-logger for logging. But calc pll cs-ctx is initialized only later in calc pll max vco construct...

PT-2026-82930

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch fq codel: Do not call qdisc tree reduce backlog during peek before restoring qlen Whenever fq codel drops packets during peek, it calls qdisc tree reduce backlog. An issue arises because it calls qdisc tree reduce...

CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

PT-2026-82946

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6 dev stats get dev get by index rcu could return NULL if the original physical device is unregistered. Found by Sashiko...

PT-2026-82931

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo decompress bio validates each on-disk segment length seg len only against the workspace cbuf size, not against the compressed input size compressed len...

PT-2026-82995

In the Linux kernel, the following vulnerability has been resolved: hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3x update client, the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16 to cpup. The pointers passed to this function are...

PT-2026-83008

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in cca clr2cipherkey The helper function ip cprb helper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could le...

PT-2026-82942

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdate flb get incoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional liveupdate flb pu...

PT-2026-83080

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts...

PT-2026-83251

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2 Description Yamcs compiles StreamSQL query expressions to Java at runtime using Janino. The LIKE operator inserts user-supplied patterns into the generated Java source unescaped. An...

PT-2026-83286

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

PT-2026-82894

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in ims pcu get cdc union desc by iterating through the extra descriptor data. However, it does not verify that t...

PT-2026-83296

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

PT-2026-83243

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo admin/endpoints.py uses superuser validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session...