CVE-2026-97526

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e paicrypto/CRYPTOALL/ -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the missing allocation of per-CPU data structures for tha...

CVE-2026-97921

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing a hist trigger whose value or variable carries a modifier that is not allowed there leaks the fields that were built for it. createvalfield takes the field fro...

PT-2026-98466

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel panic occurs when CPUs are hotplug added during the execution of the perf stat command using the pai crypto/CRYPTO ALL/ event. The issue stems from a missing allocation of per-C...

CVE-2026-97228: Improper Neutralization of Special Elements in Data Query Logic

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-93747: Improper Neutralization of Input During Web Page Generation

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profileupdate action — the raw $POST'data' array is copied into a...

PT-2026-98366

Name of the Vulnerable Software and Affected Versions Fancy Product Designer versions prior to 6.5.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs when the fpd save order AJAX action, registered...

PT-2026-98827

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter module where the nf nat sip component fails to correctly adjust the offset when Network Address Translation NAT changes the packet length. Specifically,...

PT-2026-98485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfs module where the xfs btree bload prep block function fails to release the new bp variable if the xfs btree bload drop buf function encounters an IO error while...

PT-2026-98461

Name of the Vulnerable Software and Affected Versions Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 Description A GraphQL query injection issue exists in the export-status component within the get export status function in src/export manager.py. The export id variable, which is an unvalidat...

PT-2026-98584

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails print entries uses n entries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails...

CVE-2026-98117: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix potential UAF/KASAN warning Currently, tracecachefilescoherency is being passed a pointer to a be64 lain over the coherency data in struct cachefilesxattr so that it can display the first 8 bytes. However, the dat...

PT-2026-98779

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF or KASAN warning can occur in the cachefiles module. This happens because the trace cachefiles coherency function is passed a pointer to a be64 overlaid on the...

Linux Distros Unpatched Vulnerability : CVE-2026-97526

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e paicrypto/CRYPTOALL/ -- ' crashes the kernel when CPUs are hotplug added during that run...

Linux Distros Unpatched Vulnerability : CVE-2026-98117

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cachefiles: Fix potential UAF/KASAN warning Currently, tracecachefilescoherency is being passed a pointer to a be64 lain over the coherency data in struct...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerabilities (USN-8820-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8820-1 advisory. Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication ...

Linux Distros Unpatched Vulnerability : CVE-2026-98069

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/rds: acquire the fastpath locks in rdsconnshutdown rdsconnshutdown quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL...

PT-2026-98714

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the tx spb ring full function within the bcmasp network component. The function incorrectly initializes the next index variable from intf-tx spb index during every loop...

Linux Distros Unpatched Vulnerability : CVE-2026-59980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input...

Linux Distros Unpatched Vulnerability : CVE-2026-97965

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: initialize md in vxlanxmitone If a VXLAN device is configured with both VXLANFCOLLECTMETADATA and VXLANFGBP, and a packet is transmitted through it usin...

PT-2026-98807

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/amdxdna component where the system fails to reject command chains that contain no commands. When the command count variable is zero, the payload length check...