CVE-2026-54676: Missing Authorization

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-93015: Out-of-bounds Write

BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static...

CVE-2026-54692: Incorrect Calculation of Buffer Size

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sailcodecloadframev8xbm in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file...

CVE-2026-54627: Heap-based Buffer Overflow

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psdprivatesailpixelformat in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAILPIXELFORMATBPP1INDEXED without requiring...

CVE-2026-75588: Improper Validation of Specified Type of Input

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-90219: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

CVE-2026-90259: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...

CVE-2026-90428: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs tegra241cmdqvprobe requests the error IRQ before it has allocated the cmdqv-vintfs array and set cmdqv-numvintfs. A CMDQV left enabled with a latched error...

CVE-2026-54354: Improper Neutralization of Special Elements used in an SQL Command

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml type=Integer are configured,...

CVE-2026-90982: Improper Handling of Case Sensitivity

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-93154: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Add refcounting to user ring MRs Prevent userspace from deregistering the MRs that back QP/CQ/SRQ rings by bumping the MR's refcount upon association...

CVE-2026-93050: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-90336: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: serial: core: clear freed pointers on uartregisterdriver failure uartregisterdriver leaves drv-state pointing to freed memory when ttyallocdriver fails. If ttyregisterdriver fails, drv-ttydriver also retains a pointer after its...

CVE-2026-19477: Stack-based Buffer Overflow

There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux uldaq. This may result in information disclosure or arbitrary code execution. This vulnerability affects MCC Universal Library for Linux uldaq v1.2.1 and prior versions...

CVE-2026-90372: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: avoid nss underflow in mt7915mcugetstanss If a peer's VHT/HE MCS map has no supported spatial stream all fields 0x3, the loop exits with nss == 0 and the function returned u8-1 255, which was then written into...

CVE-2026-90324: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ublk: check importubuf return value importubuf can fail if the address range provided by the userspace ublk server is outside the allowed user address space. Return that 0 bytes were copied if importubuf fails rather than passing...

CVE-2026-92490: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unrequest devices if driver registration fails scmidriverregister requests protocol devices before registering the driver. If driverregister fails, those requests remain in the global IDR and retain pointers to...

CVE-2026-90369: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy and mt76mmioreadcopy iterate up to ALIGNlen, 4, so a length that is not a multiple of four reads past the source buffer writecopy or writes past the...

CVE-2026-90361: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix leak in ath11kservicereadyextevent Currently, during ath11kservicereadyextevent processing, svcrdyext.macphycaps can be allocated during TLV parsing. This is a temporary allocation that is freed on the success...

CVE-2026-90406: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value of pmruntimeresumeandget in iriscoredeinit. If runtime PM resume fails, skip hardware power-off operations but still perform software...