PT-2026-96495

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788 charger remove flushes charger work before unregistering the IRQs. An IRQ thread can queue charger work after flush work has returned. The work can then run after...

PT-2026-96334

In the Linux kernel, the following vulnerability has been resolved: power: supply: ucs1002: fix use-after-free on remove ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the health poll delayed work, and the work reschedules itself while the chip...

PT-2026-96415

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power supply reference leak bq25890 fw probe acquires a reference to a secondary charger using power supply get by name, but the reference is not released on later probe failures or on driver detach. I...

PT-2026-96543

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb work before freeing the charger The USB-PHY notifier queues usb work, whose handler calls power supply changedbq-charger. The reset devm action only unregisters the notifier and was registered...

PT-2026-90185

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the lp8727 release irq function. The threaded IRQ handler lp8727 isr func arms pchg-work using schedule delayed work. Because lp8727 release irq cancels...

CVE-2026-89461: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instance and does not wait for a callback that is already running. If syste...

PT-2026-96513

In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030 charger: cancel workers via devm bci is devm-allocated. Two workers bci-work and bci-current worker dereference it. twl4030 bci remove disables charging and masks interrupts. It cancels neither worker. A...

PT-2026-90188

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the charger-manager component of the power supply subsystem. The problem occurs because charger manager remove and the err reg extcon probe error path...

PT-2026-90178

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Functions max17040 get vcell and max17040 get soc fail to handle errors returned by regmap read. If an I2C transfer fails, an uninitialized register value is processed and reported to...

PT-2026-96429

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr rdy work, max charging time work and batt presence work. pwr rdy work and batt presence work can also queue max charging time work...

PT-2026-96377

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimit setup work while the threaded handler...

PT-2026-90182

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qcom battmgr sc8280xp strcpy function where Pascal-style strings sent from firmware may not be properly terminated. When a firmware string fills the entire BATTMGR...

The vulnerability of the Microsoft Power Platform tools, related to insufficient validation of queries on the server side, allows attackers to escalate their privileges.

The vulnerability of the Microsoft Power Platform tools is related to insufficient testing of queries on the server side. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

Vulnerabilities in Microsoft Dynamics

Microsoft has patched 2 vulnerabilities in Dynamics, both for online and on-premise environments. These vulnerabilities allow malicious actors to gain elevated privileges, execute arbitrary code, and/or access sensitive data. Microsoft Dynamics 365: | CVE-ID | CVSS | Impact |...

CVE-2026-77897

Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally...

CVE-2026-69459

Heap-based buffer overflow in Windows Power Dependency Coordinator allows an authorized attacker to elevate privileges locally...

CVE-2026-69321

Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally...

CVE-2026-77897

CVE-2026-77897 is a relative path traversal vulnerability in Microsoft Power Automate Desktop that allows an authorized attacker to escalate privileges locally . The vulnerability requires local access with low privileges and has a high attack complexity, as reflected by the CVSS 3.1 score of 7.0...

EUVD-2026-73887

Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally...

CVE-2026-69459

CVE-2026-69459 is a heap-based buffer overflow in the Windows Power Dependency Coordinator that allows an authorized attacker to achieve local privilege escalation . The Microsoft CVSS v3.1 score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low-privilege access i...