CVE-2026-68394

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68376

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

CVE-2026-68243

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...

CVE-2026-68107

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...

UBUNTU-CVE-2026-68107

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...

CVE-2026-64941

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

CVE-2026-68394

In CVE-2026-68394, the Linux kernel Bluetooth MGMT path had a use-after-free in conn_update_sync triggered by MGMT_OP_LOAD_CONN_PARAM queuing a param update. The queued work incorrectly kept a borrowed hci_conn_params pointer; if userspace freed the entry before the callback ran, a use-after-free...

CVE-2026-68376 sctp: fix auth_hmacs array size in struct sctp_cookie

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

EUVD-2026-55562

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

EUVD-2026-55344

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...

CVE-2026-68243

CVE-2026-68243 concerns the Linux kernel’s DRM/I915 GEM component. The issue is a NULL dereference in I915_CONTEXT_PARAM_SSEU when a context engine slot N is set to I915_ENGINE_CLASS_INVALID / I915_ENGINE_CLASS_INVALID_NONE and the SSEU parameter is applied to the same slot. The vulnerability is ...

CVE-2026-68243 drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...

CVE-2026-68107 drm/amdgpu/vcn4: avoid rereading IB param length

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...

CVE-2026-68107 drm/amdgpu/vcn4: avoid rereading IB param length

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...

CVE-2026-68107

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...

EUVD-2026-55488

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72587

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...

CVE-2026-72573

An OS command injection vulnerability in 4xmen/pm2panel all versions allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec'pm2 restart ' + id without input...

CVE-2026-72580

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...