CVE-2026-53403 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fbnewmodelist to prevent null-ptr-deref in fbvideomodetovar info-var, a framebuffer's current mode, is expected to have a matching entry in info-modelist. vartodisplay relies on this and treats a failed fbmatchmode as...

CVE-2026-63793 ntfs: serialize volume label accesses

In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label accesses Protect vol-volumelabel with a mutex and snaphost the label before copytouser. This prevent a use-after-free when FSIOCSETFSLABEL replaces the vol-volumelabel and FSIOCGETTSLABEL reads it...

CVE-2026-53396 nfsd: fix posix_acl leak and ignored error in nfsd4_create_file

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak and ignored error in nfsd4createfile nfsd4createfile has two bugs in its ACL handling: The return value of nfsd4acltoattr is silently discarded. When the NFSv4-to-POSIX ACL conversion fails e.g., -EINVAL f...

EUVD-2026-45518

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak and ignored error in nfsd4createfile nfsd4createfile has two bugs in its ACL handling: The return value of nfsd4acltoattr is silently discarded. When the NFSv4-to-POSIX ACL conversion fails e.g., -EINVAL f...

CVE-2026-53396

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak and ignored error in nfsd4createfile nfsd4createfile has two bugs in its ACL handling: The return value of nfsd4acltoattr is silently discarded. When the NFSv4-to-POSIX ACL conversion fails e.g., -EINVAL f...

OESA-2026-2992 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: ppp: require CAPNETADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file-fcred-userns, while unattached administrative...

CVE-2026-16222

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress result...

CVE-2026-16216

Geex-arts django-jet up to 1.0.8 contains a CSRF flaw in the OAuth Handler that can be exploited remotely. The vulnerability enables cross-site request forgery and is public, with no response from the project to the issue. The CVE reports a MEDIUM severity (CVSS 3.x/4.x family) and indicates no l...

CVE-2026-16214 geex-arts django-jet Dashboard views.py authorization

A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and...

CVE-2026-16214

CVE-2026-16214 affects geex-arts django-jet up to version 1.0.8, specifically the Dashboard Module’s jet/dashboard/views.py component. The documentation reports an authorization bypass vulnerability caused by manipulation of an unknown function, with remote exploitation possible and a publicly av...

CVE-2026-16212

CVE-2026-16212 affects awesto django-shop up to 1.2.4. The vulnerability targets an unknown function in the file shop/models/inventory.py of the Purchase Stock Handler, causing a race condition. The issue can be exploited remotely with high complexity; exploitation status is publicly available (P...

CVE-2026-16204

Technical details for CVE-2026-16204 are not publicly provided in the supplied documents; no concrete affected versions, vulnerable components, or remediation details are available here. Monitor for updates.

PT-2026-61182

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Certain sleepable LSM Linux Security Module programs cannot be used with the bpf lsm task to inode function because it is called under rcu read lock, and the bpf lsm inet conn establishe...

PT-2026-61299

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A loop detection failure exists in the network scheduler when using mirred redirects. Specifically, when a packet is redirected to ingress from either ingress or egress, the loop state...

PT-2026-61153

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 4.1.0 Description The software fails to treat a literal backslash character U+005C as an authority delimiter. Because Node's native WHATWG URL parser normalizes backslashes to forward slashes for specific scheme...

PT-2026-61212

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f fs gadget driver where the ffs ep0 read function allocates a control-OUT data buffer using kmalloc based on the length specified in the Setup packet. When a shor...

PT-2026-61399

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where uninitialized stack data is written into a target task's register state during error conditions. In the compat riscv gpr set function, cregs to regs is called...

CVE-2026-16197

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched...

Updated libidn packages fix security vulnerability

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idnatounicodeinternal. The affected code is not present in libidn2. CVE-2026-57053...

MGASA-2026-0262 Updated libidn packages fix security vulnerability

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idnatounicodeinternal. The affected code is not present in libidn2. CVE-2026-57053...