PT-2026-98458

Name of the Vulnerable Software and Affected Versions Akia keyless entry cloud service affected versions not specified Description An Insecure Direct Object Reference IDOR exists due to missing object-level authorization. The unlock action relies on a client-supplied room or door identifier that...

PT-2026-98987

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

PT-2026-98867

Name of the Vulnerable Software and Affected Versions Gnumeric affected versions not specified Description A heap use-after-free flaw exists where the XML parser can dereference a freed sheet-object component. This occurs when a user opens a specially crafted workbook containing a malformed...

Erlang/OTP 17.0 < 27.3.4.18 / 28.0 < 28.5.0.7 / 29.0 < 29.1.1 ASN.1 OBJECT IDENTIFIER Decoder DoS (CVE-2026-65634)

The version of Erlang/OTP installed on the remote host is 17.0 prior to 27.3.4.18, 28.0 prior to 28.5.0.7, or 29.0 prior to 29.1.1. It is, therefore, affected by a vulnerability: - Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated...

DEBIAN-CVE-2026-97450

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

CVE-2026-97450

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

AZL-103694 CVE-2026-93782 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

UBUNTU-CVE-2026-97450

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

SUSE CVE-2026-65634

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

DEBIAN-CVE-2026-93277

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Validate udata before executing commands The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy...

EUVD-2026-86063

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

CVE-2026-97450 ACPICA: validate handler object type in two places

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

CVE-2026-97409 nvme-fc: Do not cancel requests in io target before it is initialized

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl-ioerrwork to abort inflight requests. This ends up calling...

EUVD-2026-86169

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

CVE-2026-93782 vhost-scsi: flush backend after device ioctls

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

EUVD-2026-86160

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

CVE-2026-96745 PHP object injection via unsuppressible __pclass class inference in command monitoring events

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

CVE-2026-96745

The MongoDB PHP Driver is vulnerable to an unauthenticated deserialization attack within its command monitoring support. When an application registers a command monitoring subscriber and processes untrusted data in a database operation, an attacker can cause the driver to honor class names embedd...

CVE-2026-96745 PHP object injection via unsuppressible __pclass class inference in command monitoring events

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

PHP object injection via unsuppressible __pclass class inference in command monitoring events

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...