CVE-2026-80883 drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1xclientregister function is called just prior to register map initialization loop, making the device available to userspace. This m...

EUVD-2026-71513

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1xclientregister function is called just prior to register map initialization loop, making the device available to userspace. This m...

CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very first register: xhci-opregs = hcd-regs +...

CVE-2026-85668 Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

CVE-2026-85668 Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

CVE-2026-85668 Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

EUVD-2026-71124

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

CVE-2026-85668: External Control of File Name or Path

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

PT-2026-91355

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input register device exposes the device to userspace immediately. In joycon input create it was called before joycon config rumble configures the FF RUMBLE capabili...

PT-2026-85561

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model path parameter without authentication or path confinement. The endpoint reads and parses config.json...

Linux Distros Unpatched Vulnerability : CVE-2026-80883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1xclientregister function is called just prior to register map...

PT-2026-85802

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the drm/tegra gr2d/gr3d component. The host1x client register function is executed before the register map initialization loop, which makes the device availabl...

CVE-2026-44506

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

EUVD-2026-70699

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

PT-2026-85218

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client secret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirect uri...

CVE-2026-44506: Exposure of Sensitive Information to an Unauthorized Actor

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

CVE-2026-53671 PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a TCTX-typed base register as a silent no-op: domemstore in src/crab/ebpftransformer.cpp only models TSTACK stores, and the...

CVE-2026-82229

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

CVE-2026-82229

An unauthenticated Cross Site Scripting (XSS) vulnerability affects the WordPress Social Login and Register plugin in versions 7.8.2 and earlier . The flaw was discovered by Patchstack researcher Ananda Dhakal and carries a CVSS 3.1 score of 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L...

CVE-2026-82229 WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...