PT-2026-64591

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do cpu nanosleep error path In do cpu nanosleep, posix cpu timer create takes a pid reference via get pid and stores it in timer.it.cpu.pid. If the subsequent posix cpu timer set call...

PT-2026-64564

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutex unlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

PT-2026-64487

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fuse module. The fuse ref folio function unlocks a request but fails to re-lock it before returning. This allows fuse chan abort to end the request,...

Linux Distros Unpatched Vulnerability : CVE-2026-64301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. O...

PT-2026-64597

In the Linux kernel, the following vulnerability has been resolved: firmware loader: fix device reference leak in firmware upload register firmware upload register - fw create instance - device initialize After fw create instance succeeds, the lifetime of the embedded struct device is expected to...

CGA-26P9-W832-5Q9C

Bulletin has no description...

GHSA-RM67-G9CH-VXFF Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Affected software - Product: Poweradmin web front-end for PowerDNS - Version tested: master, commit 7f28c3a97 also reachable in the 4.x release line — the record-edit code is the same - Component: record editing web UI - Vulnerability type: Broken Access Control / Insecure Direct Object Reference...

CVE-2026-65708

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

DEBIAN-CVE-2026-64251

In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseqdebugfsseqnext pwrseqdebugfsseqnext declares 'next' with freeputdevice, which causes putdevice to be called on the returned pointer when the variable goes out of scope. This results in a...

DEBIAN-CVE-2026-64246

In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-poweroff: fix use-after-free in the linkstationpoweroffinit Move ofnodeputdn after the ofmatchnode call, which still needs the node pointer. The node reference is correctly released after use...

CVE-2026-64246

In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-poweroff: fix use-after-free in the linkstationpoweroffinit Move ofnodeputdn after the ofmatchnode call, which still needs the node pointer. The node reference is correctly released after use...

CVE-2026-64251

In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseqdebugfsseqnext pwrseqdebugfsseqnext declares 'next' with freeputdevice, which causes putdevice to be called on the returned pointer when the variable goes out of scope. This results in a...

DEBIAN-CVE-2026-64239

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regionsrmdirs DAMON sysfs maintains the DAMOS tried region directory objects via a linked list. When the user requests refresh of the directories, DAMON sysfs removes all the region...

UBUNTU-CVE-2026-64251

In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseqdebugfsseqnext pwrseqdebugfsseqnext declares 'next' with freeputdevice, which causes putdevice to be called on the returned pointer when the variable goes out of scope. This results in a...

GHSA-P5RM-JG5C-8C77 Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Impact Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics statictemplate or the adaptive-card extension x-ai-adaptive-card, the file reference is written into the generated manifest's...

CVE-2026-65708 sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-65708 sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-65708

CVE-2026-65708 affects sysPass version 3.2.11. An insecure direct object reference in the AccountFileController lets any authenticated attacker access account file attachments they lack ACL permissions for by supplying arbitrary numeric file IDs in actions such as download, view, delete, upload, ...

EUVD-2026-48714

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

GHSA-H3RM-78G3-J7CP @better-auth/stripe: cross-organization billing tampering in organization subscription actions

Am I affected? You are affected if all of these are true: - You use @better-auth/stripe from version 1.4.11 up to a patched version below. This covers the stable line through 1.6.20 and every 1.7.0 beta through 1.7.0-beta.9. - The Stripe plugin has subscriptions turned on subscription.enabled:...