CVE-2026-28707

Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially...

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network...

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 on-premises allows an authorized attacker to disclose information over a network...

Vulnerabilities in Arista VeloCloud Orchestrator On-Prem

Arista has identified vulnerabilities in VeloCloud Orchestrator On-Prem. These vulnerabilities exist in the on-premises deployment of VeloCloud Orchestrator. There is an unauthorized endpoint that allows for the rotation of certificate authorities. Additionally, there is a Bash command injection...

CVE-2026-11893: Double Free

The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers BL60x/BL70x/BL61x, btbflbsend in drivers/bluetooth/hci/hcibflb.c, violates the bthcidriverapi.send buffer-ownership contract. That contract documented at include/zephyr/drivers/bluetooth.h requires the buffer reference to be consum...

PT-2026-70700

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 on-premises allows an authorized attacker to disclose information over a network...

PT-2026-70334

Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially...

CVE-2026-28707: Protection Mechanism Failure

Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially...

CVE-2026-65815: Deserialization of Untrusted Data

Deserialization of untrusted data in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network...

KLA91208 Multiple vulnerabilities in Microsoft Dynamics

Multiple vulnerabilities were found in Microsoft Dynamics. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in Microsoft...

CVE-2026-66301: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 on-premises allows an authorized attacker to disclose information over a network...

LLM-on-Ray Software Advisory

Summary: A potential security vulnerability for some LLM-on-Ray software may allow escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation Notice for the LLM-on-Ray software. Vulnerability Details: CVEID:...

CVE-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...

CVE-2026-68375

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68340

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...

CVE-2026-68264

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset currentop in xeptupdateopsinit xeptupdateopsinit fails to reset currentop to 0. On the vmbind path, opsexecute calls xeptupdateopsprepare inside the xevalidationguard / drmexecuntilalllocked loop. When that loop...

CVE-2026-68250

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.2: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793dfdb5af...

CVE-2026-68251

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma6.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87...

CVE-2026-68224

In the Linux kernel, the following vulnerability has been resolved: media: mali-c55: Fix possible ERRPTR in enablestreams The mediapadremotepadunique function returns either a valid pointer or an ERRPTR on failure -ENOTUNIQ if multiple links are enabled, -ENOLINK if no connected pad is found. The...

CVE-2026-68204

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...