CVE-2026-16229

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

CVE-2026-53373 mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()

In the Linux kernel, the following vulnerability has been resolved: mm/vma: do not try to unmap a VMA if mmapprepare invoked from mmap The mmapprepare hook functionality includes the ability to invoke mmapprepare from the mmap hook of existing 'stacked' drivers, that is ones which are capable of...

EUVD-2026-45445

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

CVE-2026-16229 itsourcecode Courier Management System index.php cross site scripting

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

CVE-2026-16229

The CVE reports a cross-site scripting (XSS) flaw in itsourcecode Courier Management System up to version 1.0. The vulnerability affects an unknown functionality of the file /index.php, where manipulating the argument page can trigger XSS. It is exploitable remotely, and an exploit has been publi...

CVE-2026-16219 Croogo CMS Admin File Manager FileManager.php isEditable path traversal

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published...

OESA-2026-3006 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

OESA-2026-3002 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

EUVD-2026-45416

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialcharsdecode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible ...

PT-2026-61517

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...

PT-2026-61424

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x overclock xxx put In the pcm512x chipset driver, pcm512x overclock xxx put is defined as a general mixer kcontrol instead of a DAPM kcontrol, so struct snd soc dapm conte...

PT-2026-61436

In the Linux kernel, the following vulnerability has been resolved: l2tp: use list del rcu in l2tp session unhash An unprivileged local user can pin a host CPU indefinitely in l2tp session get by ifname by issuing L2TP CMD SESSION GET on L2TP ATTR IFNAME concurrently with L2TP CMD SESSION CREATE...

PT-2026-61443

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT OP ADD EXT ADV DATA is registered as a variable-length command, with MGMT ADD EXT ADV DATA SIZE as the fixed header size. The handler then uses cp-adv data len a...

PT-2026-61452

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack buffer overflow exists in the adm1266 nvmem read blackbox function within the hwmon module. The function uses a 5-byte stack buffer when calling i2c smbus read block data to...

PT-2026-61472

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ath11k wifi driver where memory leaks occur during certain WMI WOW calls. The problem arises because the return value of the ath11k wmi cmd send function is return...

PT-2026-61367

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed becaus...

PT-2026-61469

In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommu debug is enabled Sashiko noticed a latent bug where the map error flow called iommu unmap which calls iommu debug unmap begin/iommu debug unmap end however since this is an error path the map...

PT-2026-61488

In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: fix pm runtime leak on mutex lock failure If tegra i2c mutex lock fails, the function returns without calling pm runtime put, leaking the runtime PM reference acquired by the preceding pm runtime get sync. This preven...

PT-2026-61482

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ARM integrator early initialization process. The intcp init early function calls syscon regmap lookup by compatible, which subsequently triggers of syscon register...

PT-2026-61246

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iio buffer enqueue dmabuf iio buffer enqueue dmabuf allocates a struct iio dma fence 104 bytes, kmalloc-128 via kmalloc obj+dma fence init, which sets the initial kref to 1. It then calls dma re...