CVE-2026-89767: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ovl: fix double endcreating on the casefold-mismatch path ovlcreatereal releases the new dentry twice when the casefold consistency check fails. The SIFDIR branch calls endcreating and sets err, then falls through to the common...

PT-2026-90370

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ceph component of the Linux kernel within the check new map function. The function iterates through mdsc-sessions and releases mdsc-mutex to...

PT-2026-90201

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the lockd component where the nlm traverse files function pins the current file but fails to pin the saved next pointer across a mutex unlock for nlm inspect file. Thi...

PT-2026-90377

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel's NFSD component. A local administrator with CAP SYS ADMIN privileges can trigger this by stopping the server and writing a filesystem...

kernel: smc91x: fix broken irq-context in PREEMPT_RT

A locking context bug was found in the Linux kernel's smc91x Ethernet driver on PREEMPTRT kernels. The smcspecialtrylock function disables IRQs but smcspecialunlock does not properly restore IRQs on PREEMPTRT. This mismatch causes RCU read unlock to fail in devqueuexmit, triggering a "workqueue...

kernel: smc91x: fix broken irq-context in PREEMPT_RT

A locking context bug was found in the Linux kernel's smc91x Ethernet driver on PREEMPTRT kernels. The smcspecialtrylock function disables IRQs but smcspecialunlock does not properly restore IRQs on PREEMPTRT. This mismatch causes RCU read unlock to fail in devqueuexmit, triggering a "workqueue...

QuestStack — Updated!

QuestStack QuestStack is a Meta Quest root and bootloader unlocking project. Using the GhostLock privilege escalation chain and the CVE-2021-1931 ABL/fastboot vulnerability, QuestStack provides a way to gain root access on the latest Quest 1 firmware, temporarily boot using a vulnerable ABL, and...

SUSE CVE-2026-72364

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writeback error handling Fix the error handling in writebackiter loop. If an error occurs, writebackiter needs to be called again with error set to the error so that it can clean up iteration state. Further, the curren...

PT-2026-84858

Name of the Vulnerable Software and Affected Versions UpSignOn for Windows versions prior to 7.19.0 Description Insecure credential storage allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering an authentication prompt. A standard...

CVE-2026-75136: Insufficiently Protected Credentials

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...

SUSE CVE-2026-72368

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomemdalloc error path When startcreating fails and returns -ENOMEM, it has already released the parent directory lock in startdirop: static struct dentry startdirop... ... inodelocknesteddir,...

PUB-A-486819784

In onCreate of multiple files, there is a possible unauthorized deletion of face unlock data due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

SUSE CVE-2026-72155

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked or the few first blocks, if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire...

CVE-2026-78103

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

PT-2026-82843

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gssproxy (UTSA-2026-093183)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093183 advisory. gssproxy aka gss-proxy before 0.8.3 does not unlock condmutex before pthread exit in gpworkermain in gpworkers.c. NOTE: An upstream comment states We are already on ...

CVE-2026-56710

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

CVE-2026-56710

Grav Login plugin versions prior to 1.0.16 contain a privilege validation flaw in the onApiUserListRowAction unlock handler . An attacker possessing the api.users.write permission can clear login lockout counters on admin.super accounts without holding equivalent privileges, effectively removing ...

EUVD-2026-65208

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

CVE-2026-56710

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...