CVE-2026-68197

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. A remote attacker could exploit this by configuring a malicious Access Point AP that advertises HT Capabilities but lacks HT Operation elements. When a system attempts to set up a Tunneled Direct Link Setup TDLS connection, a NULL point...

CVE-2026-68226

A flaw was found in the Linux kernel's cx23885 media driver. A local attacker could potentially trigger a null pointer dereference by causing the pciioremapbar function to fail during memory mapping in cx23885devsetup. This vulnerability could lead to a system crash, resulting in a Denial of...

Security Bulletin:Vulnerability in Kerberos 5 affects IBM Netezza Appliance

Summary The Kerberos 5 package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-40355 Vulnerability Details CVEID:CVE-2026-40355 DESCRIPTION: In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls...

CVE-2026-68225

A flaw was found in the Linux kernel's media I2C Alvium driver. The alviumctrlinit function, responsible for initializing controls, does not properly check if pointers are valid before using them. This can lead to the system attempting to write data to an invalid memory location, which could allo...

CVE-2026-72539 Windmill Labs Windmill - Information Disclosure

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-68311

A flaw was found in the Linux kernel's wifi: mt76: mt7925 driver. When handling Multi-Link Operation MLO stations, the mt7925stasetdecapoffload function can attempt to dereference a null pointer if a station link is not properly associated with a Virtual Interface VIF link. This can lead to a...

CVE-2026-68239

A flaw was found in the Linux kernel's Direct Rendering Manager drm/ttm component. A local attacker could trigger a null pointer dereference by manipulating memory pages in ttmpoolbackup. This vulnerability occurs because the system attempts to process or free memory pages that are either empty...

CVE-2026-67288

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions. Mitigati...

Security update for libarchive

This update for libarchive fixes the following issues: creating temporary files in the current working directory instead of the target directory can lead to file creation failures when the working directory is not writable bsc1254340. file descriptor leak in the mtree parser cleanup path could le...

CVE-2026-12051

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...

CVE-2026-12051 NULL pointer dereference in USB DFU device_next download handler (handle_download)

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...

CVE-2026-12051

The CVE affects Zephyr’s USB DFU, specifically the device_next USB device stack. In handle_download() the code dereferences buf without verifying buf is NULL during DFU_DNLOAD with no Data OUT stage (zero-length terminate). This NULL pointer dereference on the control endpoint after transitioning...

EUVD-2026-55939

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...

CVE-2026-12051 NULL pointer dereference in USB DFU device_next download handler (handle_download)

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...

CVE-2026-12051

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...

PT-2026-70467

Name of the Vulnerable Software and Affected Versions Windows Graphics Kernel affected versions not specified Description A null pointer dereference in the Windows Graphics Kernel allows an unauthorized attacker to cause a denial of service over a network. A null pointer dereference occurs when a...

PT-2026-70417

Name of the Vulnerable Software and Affected Versions Microsoft Remote Registry Service affected versions not specified Description A null pointer dereference in the Microsoft Remote Registry Service allows an authorized attacker to cause a denial of service over a network. A null pointer...

Linux Distros Unpatched Vulnerability : CVE-2026-68239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can ...

PT-2026-70234

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

Linux Distros Unpatched Vulnerability : CVE-2026-68139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the...