CVE-2026-90375 wifi: mt76: fix non-AQL packet accounting for MLO stations

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

CVE-2026-90325 blk-cgroup: skip dying blkg in blkcg_activate_policy()

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcgactivatepolicy When switching IO schedulers on a block device, blkcgactivatepolicy can race with concurrent blkcg deletion, leading to a use-after-free in rcuacceleratecbs. T1: T2: blkgdestroy...

CVE-2026-92983

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

EUVD-2026-81620

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

PT-2026-94420

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A signed overflow issue exists in the Stochastic Fairness Queueing sfq scheduler. When sfq init sets the q-quantum value using psched mtu, a device with an excessively large Maximum...

PT-2026-94406

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network scheduler where the qdisc get stab function accepts a user-supplied size table. The qdisc calculate pkt len function can amplify the qdisc pkt len value...

CVE-2026-54451: Uncontrolled Recursion

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...

CVE-2026-92983: Missing Release of Resource after Effective Lifetime

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

DEBIAN-CVE-2026-89812

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-89812 drm/amdgpu: force complete the MES ring fences on reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-86792

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

EUVD-2026-80321

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792

The apache-airflow-providers-apache-kafka package (versions 1.15.0 before 2.0.0) is vulnerable to arbitrary code execution on the scheduler due to unsafe reflection. The root cause is the import_string function, which resolves dotted-path strings from a Kafka connection's extra field into Python ...

CVE-2026-89976: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosuioctlsubmitjob allocates donefence before validating buffer handles. Errors after allocation call ethosujoberrcleanup, which frees the job but leaks the uninitialized fence. A...

CVE-2026-14349: Missing Authorization

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-93544

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.3 and later Description An issue exists in the LoongArch architecture where the rethook trampoline incorrectly saves and restores the $r21 $u0 register, which serves as the percpu base. When rethook trampoline handler...

CVE-2026-54637

Dragonfly (open-source P2P file distribution system) versions prior to 2.4.4-rc.3 contain an unauthenticated read-SSRF in the scheduler's v1 gRPC service. An attacker who can reach the scheduler's gRPC port (insecure by default) can supply arbitrary PeerHost.Ip and PeerHost.DownPort values, causi...