CVE-2026-92860: Improper Input Validation

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. Th...

PT-2026-94731

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The GRU TLB miss handler performs page-table walks for a process without holding page-table locks or maintaining a reference to the mapped page. Additionally, it employs a kernel...

PT-2026-94654

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ARM architecture implementation where the hw breakpoint cfi handler stub incorrectly claims breakpoint type 0x03 ARM ENTRY CFI BREAKPOINT even when Control Flow...

PT-2026-94157

Name of the Vulnerable Software and Affected Versions Paid Downloads versions prior to 3.16 Description The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the admin request handler function. This occurs because the function lacks proper authorization and...

PT-2026-94164

Name of the Vulnerable Software and Affected Versions Pressengine WordPress plugin versions prior to 1.1 Description The login handler fails to prevent the issuance of a session when authentication fails. This allows unauthenticated attackers to bypass authentication and log in as any user,...

CVE-2026-90433: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

CVE-2026-90397: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm, scm. Two paths can dereference scm before it is published, both causin...

PT-2026-94784

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the kmb ocs aes probe function requests the device IRQ before initializing irq completion. Because the handler can execute immediately upon registration, the ocs aes...

PT-2026-94779

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the remoteproc component due to a lack of synchronization between the rproc crash handler work function and the rproc del function. This allows a driver ...

PT-2026-94961

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory overread exists in the ring handler of the sensorhub component. The issue occurs because max response and sensor num are retrieved from different Embedded Controller EC commands...

CVE-2026-93165: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

PT-2026-94822

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/erdma component. The CEQ interrupt handler schedules eqc-tasklet, which executes the erdma ceq completion handler function to read the...

PT-2026-94246

Name of the Vulnerable Software and Affected Versions rcourtman Pulse versions 6.0.4 and 6.1.0-rc.4 Description Improper input validation occurs in the Quick Security Setup Handler component when processing the Username argument within the fmt.Sprintf function at the '/api/security/quick-setup'...

PT-2026-94142

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs in the device control handler when multiple threads issue concurrent IOCTL Input/Output Control requests. This issue is caused by improp...

CVE-2026-12284: Origin Validation Error

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

PT-2026-94910

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the san probe function when installing the GSBUS address space handler. This happens because the function dereferences the result of ACPI COMPANION...

PT-2026-94155

Name of the Vulnerable Software and Affected Versions Canva Desktop versions prior to 1.125.0 Description The application performs double decoding within the deeplink handler. This behavior allows a threat actor to force the application to load arbitrary same-origin content using the active user...

PT-2026-94541

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A self-deadlock occurs in the IRQ handler of the qcom-cpucp mailbox. The function qcom cpucp mbox irq fn calls mbox chan received data while holding chan-lock. In PREEMPT RT...

Linux Distros Unpatched Vulnerability : CVE-2026-92399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in GPAC 26.07.0. This affects the function rmtclienthandlewsframe of the file src/utils/rmtws.c of the component WebSocket Handle...

SUSE CVE-2026-4833

A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the...