CVE-2026-90455

This vulnerability involves a reverted update to a bundled HTTP client library within a log-processing component , reintroducing a previously vulnerable version. The root cause is that a prior patch raising the library to a fixed version was undone, restoring the vulnerable code. However, the onl...

CVE-2026-89741

CVE-2026-89741 affects the Linux kernel V4L2 subsystem, specifically the __video_register_device() function. A prior patch (commit 2a934fdb01db) attempted to improve error handling by calling put_device() when device_register() fails, but this conflicts with the V4L2 API contract requiring caller...

CVE-2026-80636

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 "netfilter:...

CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-30864

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting XSS in the dashboard revert functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30864 Combodo iTop: Reflected XSS in dashboard revert

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting XSS in the dashboard revert functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30864

Combodo iTop versions prior to 3.2.3 are susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard revert functionality . An authenticated attacker (low privileges) can craft a malicious URL that, when clicked by a victim, executes arbitrary script in the victim's brows...

CVE-2026-30864 Combodo iTop: Reflected XSS in dashboard revert

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting XSS in the dashboard revert functionality. This issue has been fixed in version 3.2.3...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Properly handle cases where an enclosure contains only one primary component. This fix reverts to commit 3fe97ff3d949 “scsi: ses: Do not attach if the enclosure has no components”. It also introduces proper handling fo...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: “Bluetooth: btsdio: fix use after free bug in btsdioRemove due to unfinished work” This issue has been resolved through commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. This patch may introduce a potential null-ptr-def problem...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “Revert ‘f2fs: fix to do sanity check on extent cache correctly’” The syzbot reports a bug in f2fs as follows: UBSAN: Array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19 Index 1409 is out of range for type ‘le32923’ aka ‘unsigned...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Now treats platformmax consistently as a control value. This change is reflected in commit 9bdd10d57a88 “ASoC: ops: Shifted test values in sndsocputvolsw by +min”, and some additional related updates have been made...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bamdma: fix runtime PM underflow The commit dbad41e7bb5f “dmaengine: qcom: bamdma: check if the runtime pm enabled” caused unbalanced pmruntimeget/put calls when the bam was controlled remotely. This commit rever...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In usbnet, there was a flaw where unregisternetdev was called before unbind. The commit with the commit ID 2c9d6c2b871d “usbnet: run unbind before unregisternetdev” was intended to fix a use-after-free issue when disconnecting US...

PT-2026-80995

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web-based IT service management tool. The software contains a Reflected Cross-Site Scripting XSS flaw within the dashboard revert functionality. Reflected XSS occurs when an...

CVE-2026-74604

In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce "thermal/drivers/hwmon: Cleanup coding style a bit" that introduced a use-after-free into the error path of thermaladdhwmonsysfs by removing a...

UBUNTU-CVE-2026-74604

In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce "thermal/drivers/hwmon: Cleanup coding style a bit" that introduced a use-after-free into the error path of thermaladdhwmonsysfs by removing a...

CVE-2026-74604

CVE-2026-74604 is a use-after-free vulnerability in the Linux kernel's thermal/drivers/hwmon component. It was introduced by commit 030a48b0f6ce ("thermal/drivers/hwmon: Cleanup coding style a bit"), which removed a valid check from the error path of thermal_add_hwmon_sysfs() . The fix is a rever...

CVE-2026-74604 Revert "thermal/drivers/hwmon: Cleanup coding style a bit"

In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce "thermal/drivers/hwmon: Cleanup coding style a bit" that introduced a use-after-free into the error path of thermaladdhwmonsysfs by removing a...

Unbreakable Enterprise kernel security update

5.15.0-322.203.3.5 - Revert 'x86/alternatives: Add altinstr.flags' Harshit Mogalapalli Orabug: 39859219 5.15.0-322.203.3.4.5 - KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults David Matlack Orabug: 39832946 - KVM: x86: Check for invalid/obsolete root after making MMU...