PT-2026-94609

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs zoned filesystem where the btree writepages function writes dirty metadata in ascending logical address order. On zoned filesystems, only one metadata and on...

CVE-2026-90054: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urgptr: / tcpwritexmit / limit = mssnow; if...

CVE-2026-90418: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfscopydirtypages on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfscopydirtypages, which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved...

PT-2026-95065

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.7.0 Description An authenticated user with the HR User role can perform SQL injection through filters in the Salary Payments Based on Payment Mode report. The issue occurs in the salary payments based on payment...

CVE-2026-90382: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a...

PT-2026-95073

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description When the logging mode is configured as DEBUG or a malformed MongoDB connection string is utilized, application logs may inadvertently capture sensitive data,...

PT-2026-94402

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP retransmit path where the system fails to restrict the creation of multi-segment packets while in urgent mode. Unlike the normal transmission path, the tcp...

CVE-2026-90179: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix deadlock in complain-mode changehat The use of changehat when in complain mode can cause a deadlock when the hat doesn't exist and a new learning profile is created for the missing profile. This is because changehat...

Linux Distros Unpatched Vulnerability : CVE-2026-59969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true,...

Fedora 45 : freeipmi (2026-abe39f1809)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-abe39f1809 advisory. Updates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-8550...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : AOM vulnerabilities (USN-8772-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8772-1 advisory. It was discovered that AOM incorrectly handled the first-pass statistics buffer in Look-Ahead Processing...

PT-2026-94614

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In zoned file systems, the btrfs delayed refs rsv refill function returns -EAGAIN when the sum of over-committed metadata and zone unusable bytes exceeds the usable size in a metadata...

PT-2026-94766

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel BUG occurs within the nilfs copy dirty pages function, which is responsible for copying dirty DAT file folios or pages to the shadow page cache. The issue is triggered when a...

react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode

A flaw was found in React Router when operating in Framework Mode. A remote attacker could exploit an existing prototype pollution vulnerability within the application code. This could lead to unauthorized remote code execution RCE on the server through a two-step attack involving external...

CVE-2026-90997

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-89817

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

AZL-101306 CVE-2026-89817 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

CVE-2026-89817 drm/gud: NUL-terminate TV mode names read from the device

In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...

Improper Validation of Certificate with Host Mismatch

Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the...

CVE-2026-77190

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically...