EUVD-2026-82108

In the Linux kernel, the following vulnerability has been resolved: exfat: fix validsize extension over a shared writable mapping When a shared writable mapping has its validsize extended by a buffered write or a page fault, exfat zeroes the page-cache gap below the new validsize. A store through...

CVE-2026-92487 exfat: fix valid_size extension over a shared writable mapping

In the Linux kernel, the following vulnerability has been resolved: exfat: fix validsize extension over a shared writable mapping When a shared writable mapping has its validsize extended by a buffered write or a page fault, exfat zeroes the page-cache gap below the new validsize. A store through...

CVE-2026-92477 scsi: ufs: debugfs: Reserve space for a string terminator

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: debugfs: Reserve space for a string terminator ufssavederrwrite copies user input into a zero-initialized stack buffer and passes it to kstrtoint. A write that fills the entire buffer overwrites its only terminator...

CVE-2026-90358 bpf, x86: Fix trampoline stack size for 128-bit arguments

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-90108

CVE-2026-90108 is a memory leak in the Linux kernel 's net/smc subsystem. When smc_llc_event_handler() transitions the local LLC flow from SMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK, it overwrites flow->qentry via smc_llc_flow_qentry_set() without first freeing a previously stashed ent...

CVE-2026-90086

CVE-2026-90086 affects the Linux kernel AF_XDP (xsk) zero-copy TX path . The root cause is that the zero-copy path reads TX metadata whenever the UMEM has metadata space, even when the descriptor does not set the XDP_TX_METADATA flag. The fix passes descriptor options through the metadata helpers...

CVE-2026-90086 xsk: honor XDP_TX_METADATA in zero-copy path

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

CVE-2026-86861

pgAdmin 4 's File Manager save_file endpoint (used by the Query Tool and ERD) contained a TOCTOU race : after validating a path with check_access_permission(), it opened the file with a plain open() call lacking the O_NOFOLLOW protection that the separate upload path had gained in CVE-2026-7819. ...

WordPress Iptanus File Upload plugin < 5.1.7 - File Overwrite via Race Condition vulnerability

File Overwrite via Race Condition vulnerability discovered by Luca Jungnickel in WordPress Plugin WordPress File Upload versions 5.1.7...

EUVD-2026-81013

Redocly CLI: Path traversal when using split command...

CVE-2026-92919

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

WordPress MultiVendorX plugin 5.0.0-5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite vulnerability

Subscriber+ Arbitrary Store Data and Ownership Overwrite vulnerability discovered by Farid Narimanov in WordPress Plugin MultiVendorX versions 5.0.0-5.0.15...

PT-2026-95078

Name of the Vulnerable Software and Affected Versions SAIL versions prior to 1.0.0 Description A heap overwrite occurs in the sail codec load frame v8 xbm function within src/sail-codecs/xbm/xbm.c when processing X10 static short files. The issue arises because the decoded pixel buffer is allocat...

PT-2026-94250

Name of the Vulnerable Software and Affected Versions admin3 version 3.0.0 Description The upload handler fails to sanitize client-supplied filenames on Windows deployments. This allows authenticated users to use dot-dot path segments in filenames to escape the configured storage directory and...

PT-2026-94137

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.111 Description The plugin contains an issue related to insufficient credential protection. The Ai1wm Main Controller::init function, which is registered on the admin init hook and execute...

PT-2026-95014

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager fails to perform a preflight check for non-directory assets that already exist on the disk during package installation. The logic within libmport/check preconditions.c,...

CVE-2026-86864: Improper Neutralization of Argument Delimiters in a Command

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/ /object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with...

CVE-2026-90339: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: powerpc/syscall: Fix syscall skip handling for seccomp and ptrace After enabling GENERICENTRY on PowerPC, syscallenterfromusermode returns -1 as a sentinel to signal that seccomp or ptrace has intercepted the syscall and already...

CVE-2026-54692: Incorrect Calculation of Buffer Size

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sailcodecloadframev8xbm in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file...

PT-2026-94706

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem on x86 architectures where the trampoline stack size is incorrectly calculated for 128-bit arguments. The btf distill func proto function accepts...