CVE-2026-81178: Incorrect Authorization

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and...

Linux Distros Unpatched Vulnerability : CVE-2026-92474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component...

MAL-2026-16270 Malicious code in @tink/tink-link-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf The package impersonates the Tink open-banking SDK name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage...

Malicious code in @tink/tink-link-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf The package impersonates the Tink open-banking SDK name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage...

CVE-2026-90392

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...

AZL-101858 CVE-2026-90392 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...

DEBIAN-CVE-2026-90349

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

GHSA-H7VF-4X9W-H99V oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...

EUVD-2026-80871

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing...

CVE-2026-93111 bpf: Mark tracing_multi trampolines as ftrace managed

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark tracingmulti trampolines as ftrace managed Since tracingmulti link does not set ftracemanaged, it would fail to release the tracingmulti link when attaching tracingmulti link and then attaching fentry link. 3.714215...

CVE-2026-93111

This vulnerability affects the Linux kernel BPF subsystem, specifically the tracing_multi trampoline mechanism. The root cause is that the tracing_multi link does not set the ftrace_managed flag, which causes the link to fail release when a tracing_multi link is attached followed by an fentry lin...

CVE-2026-90392 bpf: Fix potential UAF when reading bpf link info

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...

CVE-2026-90392

CVE-2026-90392 is a Use-After-Free (UAF) vulnerability in the Linux kernel's BPF subsystem. In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, the link->prog pointer is accessed without holding any locks. If the program is concurrently replaced via bpf_link_update, the old program can be fre...

CVE-2026-90355 wifi: mt76: mt7996: clear stale link state on full reset

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: clear stale link state on full reset After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996viflinkadd short-circuits when the linkid is still marked in...

CVE-2026-90349 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-90349

CVE-2026-90349 is an out-of-bounds array access in the Linux kernel's mt76 mt7996 Wi-Fi driver. In mt7996_tx() , when mac80211 leaves the link unspecified, the primary link id is IEEE80211_LINK_UNSPECIFIED (0xf) —a value of 15—yet it is used unchecked to index vif->link_conf[] , mvif->mt76....

CVE-2026-90349 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...

CVE-2026-86861 pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check

pgAdmin 4's File Manager savefile endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.checkaccesspermission and then opened the file for writing with a plain open call. CVE-2026-7819 had previously hardened the separate file upload path by openi...

CVE-2026-86861 pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check

pgAdmin 4's File Manager savefile endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.checkaccesspermission and then opened the file for writing with a plain open call. CVE-2026-7819 had previously hardened the separate file upload path by openi...