UBUNTU-CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

UBUNTU-CVE-2026-89586

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes atascsiwritesamexlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by...

UBUNTU-CVE-2026-89500

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...

UBUNTU-CVE-2026-89499

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

UBUNTU-CVE-2026-89551

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdrbuftrim: clamp buf-len to avoid underflow xdrbuftrim trims len bytes from the tail of an xdrbuf by walking the tail, pages, and head iovecs. Each per-section step uses mint so it never removes more bytes than that...

UBUNTU-CVE-2026-89670

In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsdfile objects are freed via callrcu filecache.c:296, and nfsdfileslab is created without SLABTYPESAFEBYRCU KMEMCACHEnfsdfile, 0 at filecache.c:789, so the slab page backing a freed...

UBUNTU-CVE-2026-89578

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DMIOBIO requests, doregion built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

UBUNTU-CVE-2026-89642

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecacheisizeextended in cifssetsize when extending cifssetsize calls truncatepagecache but skips pagecacheisizeextended on extension. truncatesetsize shows the correct pattern: isizewriteinode, newsize; if newsize...

CVE-2026-77490

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

EUVD-2026-76689

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-81917

Concrete CMS versions below 9.5.3 contain a Stored XSS vulnerability in the Document Library block . The block controller returned the file description and tags values without applying the h() HTML-escaping function (already used for the title column), and the block view template wrote those valu...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-68535

Concrete CMS versions 9.2.0 through 9.5.2 are affected by a missing authorization check in the Area REST API block-create endpoint. The endpoint failed to invoke the block type controller's validate() method, which is responsible for authorizing referenced files against the user's file-manager vi...

EUVD-2026-76688

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

EUVD-2026-76684

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...