CVE-2026-53401

The CVE-2026-53401 vulnerability affects the Linux kernel fbdev omap2 driver (omapfb_mmap) with a race between mm_lock and fb_info->lock when mapping memory via OMAPFB_SETUP_PLANE. The race can lead to a use-after-free by reading start/len from mismatched region references and incrementing an ...

CVE-2026-53383 ksmbd: reject non-VALID session in compound request branch

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

EUVD-2026-45428

A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the argument projectid leads to authorization bypass. It is...

EUVD-2026-45409

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/accesscontrol.go of the component First Run Setup. Performing a manipulation of the argument allowedcidrs results in authentication bypass using alternate...

CVE-2026-16198

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/accesscontrol.go of the component First Run Setup. Performing a manipulation of the argument allowedcidrs results in authentication bypass using alternate...

PT-2026-61213

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the WebUSB GET URL handler within the composite setup function. When the host-supplied wLength is smaller than the WEBUSB URL DESCRIPTOR HEADER LENGTH, an...

PT-2026-61088

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module during the handling of SMB2 compound requests. The smb2 check user session function fails to verify if a session is in the SMB2 SESSION VALID state fo...

PT-2026-61106

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.3 Description A race condition exists in the omap2 framebuffer driver within the omapfb mmap function and the OMAPFB SETUP PLANE ioctl. The fb mmap entry point holds the mm lock but not the fb info-lock, whil...

PT-2026-61336

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A DMA mapping leak occurs in the nvme-pci module during data setup errors. The leak happens during iteration if the tracking descriptor for either PRP Physical Region Page or SGL Scatter...

PT-2026-61461

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Bluetooth btmtk driver. The setup packet of the control urb is not properly freed when usb submit urb fails or when the submitted urb is killed. Recommendatio...

PT-2026-61318

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ALSA PCM OSS component. The function snd pcm oss proc write links a newly allocated setup entry into the OSS setup list before duplicating the ta...

PT-2026-61487

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the spi: qup driver where the system may dereference an error pointer if DMA Direct Memory Access setup fails during the probe process. When DMA setup fails, the drive...

CVE-2026-16198 Sipeed PicoClaw First Run Setup access_control.go authentication bypass

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/accesscontrol.go of the component First Run Setup. Performing a manipulation of the argument allowedcidrs results in authentication bypass using alternate...

CVE-2026-16198 Sipeed PicoClaw First Run Setup access_control.go authentication bypass

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/accesscontrol.go of the component First Run Setup. Performing a manipulation of the argument allowedcidrs results in authentication bypass using alternate...

CVE-2026-16198

The CVE affects Sipeed PicoClaw ≤ 0.2.9, specifically the First Run Setup’s web/backend/middleware/access_control.go where manipulation of the allowed_cidrs argument enables authentication bypass via an alternate channel. The issue can be triggered remotely and has high attack complexity with no ...

Malicious code in tinkoff-cloud-apis-internal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421b85b858849bbf116303f2dc2740180df602dfc162f7ce7fa109e4c39b07ff The package installs a telemetry.pth file into site-packages via a custom install cmdclass; the.pth line imports telemetryinit, causing every...

MAL-2026-10916 Malicious code in python-devplatform-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a The package's setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports telemetryinit, whi...

EUVD-2026-45370

A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setupconntrack of the file /sbin/rc. Executing a manipulation of the argument cttcptimeout can lead to out-of-bounds write. The attack may be performed from remote. This project is supersed...

CVE-2026-16095 Shibby Tomato rc setup_conntrack out-of-bounds write

A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setupconntrack of the file /sbin/rc. Executing a manipulation of the argument cttcptimeout can lead to out-of-bounds write. The attack may be performed from remote. This project is supersed...