PT-2026-93336

A flaw was found in jwcrypto. The JWK.import key function validates the key ops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of key ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key ops array to an application...

CVE-2026-92359: Permissive Cross-domain Policy with Untrusted Domains

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function createstrandsapp of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38576)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setWiFiWpsStart function. Attackers can exploit this vulnerability by sending a specially crafted POST...

CVE-2026-89798: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...

Linux Distros Unpatched Vulnerability : CVE-2026-89942

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: buffer: Fix potential use-after-free in anonymous buffer release An anonymous buffer handle holds a reference to the underlying IIO device. The reference i...

Linux Distros Unpatched Vulnerability : CVE-2026-89986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/mempolicy: fix sleeping allocation in allocpagesbulkweightedinterleave syzbot reported a sleeping function called from invalid context splat in...

Linux Distros Unpatched Vulnerability : CVE-2026-89934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: light: ltrf216a: fix runtime PM reference leak in error path ltrf216agetlux acquires a runtime PM reference by calling ltrf216asetpowerstatedata, true...

CVE-2026-92402: Missing Authorization

A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack ca...

ROS-20260916-73-0006

The vulnerability of the nvmedbbufset function in the drivers/nvme/host/pci.c file of the NVME kernel driver in Linux is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability can allow an attacker to increase their privileges or execute arbitrary code...

CVE-2026-90044: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix Use-After-Free in AIO error path In ffsepfilewriteiter and ffsepfilereaditer, when ffsepfileio fails with an error other than -EIOCBQUEUED, the iodata structure p is freed. However, for AIO operations, the...

CVE-2026-92217: Improperly Controlled Modification of Dynamically-Determined Object Attributes

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

The vulnerability of the formAdvFirewall function in D-Link DIR-605L router software allows a hacker to execute arbitrary commands.

The vulnerability of the formAdvFirewall function in D-Link DIR-605L router microprogramming systems is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

ROS-20260916-73-0088

The vulnerability of the decodechoice function in the net/netfilter/nfconntrackh323asn1.c module of the netfilter kernel in the Linux operating system is related to reading data beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or...

TencentOS Server 4: gvfs (TSSA-2026:1011)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1011 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-89950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: mcast: linearize skbuff for packet generation batadvmcastforwpacket and batadvmcastforwscrape is not only called indirectly by the...

Linux Distros Unpatched Vulnerability : CVE-2026-89799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Disable preemption in bpfgetstackid The getperfcallchain call needs disabled preemption plus we need it disabled as long as we access its returned trace...

Linux Distros Unpatched Vulnerability : CVE-2026-89960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/vfio-ap: fix stale pqaphook pointer on error in vfioapmdevsetkvm In vfioapmdevsetkvm, kvm-arch.crypto.pqaphook is set to &matrixmdev-pqaphook before the...

Linux Distros Unpatched Vulnerability : CVE-2026-89837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix dentry folio leak in findinlevel findinlevel gets a dentry folio with f2fsfinddatafolio before calling findinblock. If findinblock returns an error, t...

Linux Distros Unpatched Vulnerability : CVE-2026-90825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the...

Linux Distros Unpatched Vulnerability : CVE-2026-90013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Take tracearray reference when opening options file The options files do not take the tracearray reference for the options they represent. This could...