CVE-2026-44011-poc

CVE-2026-44011 Craft CMS 中通过 Yii 行为注入实现的已认证 RCE。 受影响版本： 4.0.0–4.17.11, 5.0.0–5.9.17 修复版本： 4.17.12, 5.9.18 安全公告： GHSA-qrgm-p9w5-rrfw 漏洞 /admin/actions/element-search/search 端点接受一个 condition 参数，该参数会被直接传入 ElementCondition::createCondition，而不会先调用 Component::cleanseConfig。这意味着当 FieldLayout...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 1.0 - NRS have been addressed in version 3.0.5.4 Vulnerability Details CVEID:CVE-2026-62574 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Ja...

AZL-106302 CVE-2026-98349 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

DEBIAN-CVE-2026-98349

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

CVE-2026-98349

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

AZL-106086 CVE-2026-98348 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

DEBIAN-CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

AZL-106434 CVE-2026-98328 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

DEBIAN-CVE-2026-98328

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

CVE-2026-98328

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

DEBIAN-CVE-2026-98291

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex == rxq-count to pass through and index one element past the end of t...

CVE-2026-98291

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex == rxq-count to pass through and index one element past the end of t...

DEBIAN-CVE-2026-98190

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

AZL-106056 CVE-2026-98190 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

CVE-2026-98190

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

DEBIAN-CVE-2026-98183

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211meshpreqsizeok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header...

DEBIAN-CVE-2026-98186

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiexsearchouiinie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing...

AZL-106134 CVE-2026-98186 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiexsearchouiinie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing...

CVE-2026-98183

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211meshpreqsizeok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header...