CVE-2026-72182: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

PT-2026-72197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference issue exists in the mediatek power domain driver. The driver unconditionally attempts to perform cleanup for DIRECT CTL domains when a probe fails for HW VOTER...

PT-2026-72196

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A timing issue exists in the i.MX8MP VC8000E power up sequence where the VC8000E reset de-assertion edge and AXI clock may conflict. This can cause the VPU NOC power down handshake to ha...

PT-2026-72520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the Linux kernel when the function amdxdna hwctx sync debug bo invokes the hardware hwctx sync debug bo callback while holding the xdna-dev lock lock. This callback...

PT-2026-72198

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the imx93-blk-ctrl power domain where the MIPI DSI and CSI domains share control bits for clock and reset. This shared configuration can result in incorrect behavior i...

PT-2026-72331

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the platform/x86 ISST component where the SST-PP control offset is only restored to power domain 0 after a resume operation, despite control values being read and stor...

PT-2026-72370

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A refcount leak occurs in the is full charged function within the charger-manager component. The issue arises when power supply get by name is used to obtain a reference to the fuel gaug...

PT-2026-72707

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An array overrun occurs in the power supply populate supplied from function when the power-supplies DTS property contains multiple values. This leads to an out-of-bounds access when...

Linux Distros Unpatched Vulnerability : CVE-2026-72007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence Per errata1: ERR050531: VPUNOC power down handshake may hang during VC8000E/VPUMIX power up/down cycling...

Linux Distros Unpatched Vulnerability : CVE-2026-72031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD The PNY CS900 1TB SSD Phison PS3111-S11, DRAM- less drops off the bus after entering Device-Initiated...

PT-2026-72175

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sdhci-esdhc-imx driver where the use of pm runtime get sync during suspend requires complex error handling. If the process fails, the device remains unclocked, and...

PT-2026-72902

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the drm/amd/pm component. The function amdgpu dpm get pp table returns a pointer to a driver-owned power table after releasing the adev-pm.mutex. If a...

PT-2026-72767

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, the fw pm notify function calls...

PT-2026-72181

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mwifiex wifi driver where the mwifiex ret 802 11 associate function unconditionally sets the ps state variable to PS STATE AWAKE when processing an association...

PT-2026-72220

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libata-core component where the PNY CS900 1TB SSD Phison PS3111-S11, DRAM-less drops off the bus after entering Device-Initiated Slumber during idle periods. When...

Linux Distros Unpatched Vulnerability : CVE-2026-72009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to...

Linux Distros Unpatched Vulnerability : CVE-2026-74450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/pm: fix pptable use-after-free amdgpudpmgetpptable returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then...

The vulnerability of the Microsoft Power Apps development environment, related to incorrect authentication, allows a perpetrator to increase their privileges.

The vulnerability of the Microsoft Power Apps development environment is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

CVE-2026-73304

Summary: Budibase prior to 3.39.25 exposed OAuth2 tokens (oauth2.accessToken, oauth2.refreshToken) in user metadata responses. The list endpoint (/api/users/metadata) and the single-user endpoint (/api/users/metadata/:id) return full user profiles without removing these fields, enabling any user ...

CVE-2026-73304 Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...