PT-2026-82954

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use after free issue exists in the Linux kernel within the xilinx soc component. The problem occurs during the device removal process when the mbox request channel byname function is...

PT-2026-86702

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mbox request channel byname in probe. In remove callback, the rx mailbox channel is cleaned up when the rx chan is NULL due to incorrect...

PT-2026-82957

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/amdxdna component where management mailbox channel cleanup helpers may be triggered during error handling paths after the mgmt chann has already been...

Linux Distros Unpatched Vulnerability : CVE-2026-80654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mboxrequestchannelbyname in probe. In remove callback, the rx mailbox...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UI (CVE-2026-3157)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure in mailbox UI. Vulnerability Details CVEID:CVE-2026-3157 DESCRIPTION: IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through...

SUSE CVE-2026-72486

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

CVE-2026-54467

On the Trusted Firmware-M TF-M 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer...

CVE-2026-54467

On the Trusted Firmware-M TF-M 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer...

CVE-2026-54467

On the Trusted Firmware-M TF-M 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer...

CVE-2026-54467

On the Trusted Firmware-M TF-M 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer...

CVE-2026-54467

Trusted Firmware-M (TF-M) versions 2 through 2.3.0 (before commit 00d1b3e) contain a vulnerability in the mailbox initialization routine on PSOC64 and RP2350 platforms. The root cause is acceptance of a non-secure, unvalidated pointer supplied during initialization, which could allow compromise o...

CVE-2026-54467

On the Trusted Firmware-M TF-M 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer...

CVE-2026-54467

On the Trusted Firmware-M TF-M 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer...

PT-2026-81926

On the Trusted Firmware-M TF-M 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer...

CVE-2026-54467: Unverified Ownership

On the Trusted Firmware-M TF-M 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer...

DEBIAN-CVE-2026-65053

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

EUVD-2026-64899

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: mailbox: mtk-adsp: fixed a UAF use-after-free during device teardown. When the SOF audio driver fails to initialize e.g., due to a firmware boot timeout, its devices release the sndsofdev object that the mailbox client...

JetBrains YouTrack < 2025.3.156085 / 2026.1.x < 2026.1.13914 / 2026.2.x < 2026.2.18095 Missing Authorization (CVE-2026-75044)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.156085, 2026.1.x prior to 2026.1.13914, or 2026.2.x prior to 2026.2.18095. It is, therefore, affected by a missing authorization vulnerability: - Missing authorisation allowed an authenticated user to delete arbitra...

CVE-2026-16707

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox...