PT-2026-82920

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the iounmap function is called a second time with a NULL pointer. This occurs during the error path of the msix capability init function when msix setup interrupts...

PT-2026-83234

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.4.0 Description An issue exists where the project view id value in the request body can be mass assigned via the Bucket.Update function in pkg/models/kanban.go. While the system validates that the bucket belongs to...

PT-2026-82914

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the emac probe function. This occurs because devm request irq is called before devm platform ioremap resource, allowing an early interrupt to trigger...

PT-2026-82934

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter flowtable component where a post-decrement of the num encaps variable occurs within the DEV PATH BR VLAN UNTAG case. Because num encaps is an unsigned...

PT-2026-82970

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap read exists in the machine resolve function. The issue occurs because the function accesses env-cpual-cpu.socket id without validating the al-cpu variable against...

CVE-2026-80619: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aareplaceprofiles The function aareplaceprofiles was accessing udata-size after calling aaputloaddataudata, causing a potential UAF. Fixed this by saving the size to a local variable before dropping...

PT-2026-82860

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor course filter ajax AJAX action. This is due to missing authorization on the handl...

CVE-2026-16759: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

Linux Distros Unpatched Vulnerability : CVE-2026-80710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct...

openSUSE 16 Security Update : gh (openSUSE-SU-2026:21663-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21663-1 advisory. Changes in gh: - Update to version 2.98.0: chore: fix extra whitespace Default Codespaces port forwarding to loopback Bump gh-aw-actions to...

PT-2026-83251

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2 Description Yamcs compiles StreamSQL query expressions to Java at runtime using Janino. The LIKE operator inserts user-supplied patterns into the generated Java source unescaped. An...

PT-2026-86735

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmt buffer size in dasd eckd check device format is declared as int, even though one of the multiplicands, sizeofstruct eckd count, is a size t. The expression trkcount rpt max...

PT-2026-83243

Name of the Vulnerable Software and Affected Versions Piccolo Admin versions prior to 1.14.0 Description Piccolo Admin contains an authorization bypass and sensitive information leak. The superuser validators function in piccolo admin/endpoints.py uses a deny-list that blocks PUT, PATCH, DELETE,...

WS-2026-0034

The algofrompickle function in monai/auto3dseg/utils.py deserializes attacker-controlled data with pickle.loads at three call sites, with isinstance and key validation performed only after deserialization, so remote code execution fires before any check. An earlier advisory stated the issue was...

PT-2026-82919

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the AppArmor module. The aa replace profiles function accesses the udata-size variable after the aa put loaddataudata function has been called, which...

PT-2026-83017

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the sctp verify param function accepts an Adaptation Layer Indication parameter that contains only a header, despite the parameter...

PT-2026-82971

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The register pid function contains multiple flaws when processing untrusted perf.data. An integer overflow can occur on 32-bit systems when a large pid is used, leading to out-of-bounds...

PT-2026-83010

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/dasd component where the fmt buffer size variable in the dasd eckd check device format function is declared as an int. When calculating the buffer size using...

PT-2026-83229

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.21.0 through 2.3.0 Description An authorization bypass exists in the project duplication process. An authenticated user with read access to a source project can duplicate it and place the copy under any arbitrary target pare...

PT-2026-82984

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference occurs in the KVM s390 PCI component when the airq iv create function fails to allocate an AIBV Airq Interrupt Vector and returns NULL. Because the return value was no...