CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-56827

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-49439 OpenRemote read-only asset users can write predicted datapoints

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue...

CVE-2026-50025 Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse MAM session...

CVE-2026-59971

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-49464 NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

CVE-2026-81907 Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-81916

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...

CVE-2026-49462

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features...

CVE-2024-56344

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-89772

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-89773

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dmstreamctx that should skip configuring HDCP routine. The routine is valid to go through only when a valid stream is created...

CVE-2026-89771

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...

CVE-2026-89770

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

CVE-2026-89768

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backingfileopen derives the path to be stored in the new backing file from userfile-fpath. This is incorrect when userfile itself is a backing file, which is the case for nested stacking...

CVE-2026-89769

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhpsetupstate error path When cpuhpsetupstate fails after pitclockeventpercpuinit has successfully called requestirq, the error handling jumps directly to outpitclocksourceunregister...

CVE-2026-89767

In the Linux kernel, the following vulnerability has been resolved: ovl: fix double endcreating on the casefold-mismatch path ovlcreatereal releases the new dentry twice when the casefold consistency check fails. The SIFDIR branch calls endcreating and sets err, then falls through to the common...

CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89764

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

CVE-2026-89765

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

CVE-2026-89763

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

CVE-2026-89762

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89760

In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in the swap cache is freed when the folio leaves the cache, not when its count drops. swapputentriescluster follows that rule...

CVE-2026-89761

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aavecunique null terminates at vecn - dups when VECFLAGTERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the...

CVE-2026-89759

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleakscan scans every task stack under one rcureadlock with no reschedule point, which can trip the...

CVE-2026-89758

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe "mm/hugememory: add device-private THP support to PMD operations" a PMD may...

CVE-2026-89756

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migratepagesbatch migratepagesbatch unmaps each folio before moving it, and every unmap runs the mmunotifier invalidate callbacks. On KVM hosts trytomigrate ends up in...

CVE-2026-89757

In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable folio handling sortfolio has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follow...

CVE-2026-89755

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: clear stale mapping after freeing swapcache migratedevicepages reads the folio mapping before calling foliofreeswap. When foliofreeswap succeeds, the folio is removed from the swap cache, but the saved mapping...

CVE-2026-89754

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walkpmdrange If -pmdentry sets walk-action = ACTIONAGAIN, the pmdnone check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-installpte is not...

CVE-2026-89753

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shrinklruvec I am seeing some rcutasks stalls in the Meta fleet during reclaim. INFO: rcutasks detected stalls on tasks: 0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idlecpu: -1...

CVE-2026-89752

In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a limit update is superseded kernfs serializes file operations only per open file, so separate open files can update the same memory.high or memory.max file concurrently. Both handlers store the new...

CVE-2026-89751

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89750

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...

CVE-2026-89749

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...

CVE-2026-89748

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

CVE-2026-89747

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...

CVE-2026-89746

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...

CVE-2026-89744

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnodeforeachchildnode When iterate over children of a fwnode that has a secondary fwnode, fwnodegetnextchildnode can enter an infinite loop if the secondary fwnode has more than one child...

CVE-2026-89745

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmapprepare Commit 651fdda8406d "relay: update relay to use mmapprepare" changed the mmap file operation to mmapprepare for relayfs, but the lockdown check in debugfs was not updated accordingly...

CVE-2026-89743

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...

CVE-2026-89742

In the Linux kernel, the following vulnerability has been resolved: rapidio: mportcdev: fix use-after-free in dmareqfree dmareqfree acquires bufmutex through req-map, drops the mapping reference with krefput, and then dereferences req-map again to unlock the mutex. If krefput drops the last...

CVE-2026-89740

In the Linux kernel, the following vulnerability has been resolved: serial: imx: serialize imxuartports lifetime imxuartprobe publishes its devm-allocated port in imxuartports before uartaddoneport because console setup uses the table. The entry is not cleared when adding the port fails or after...

CVE-2026-89741

In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in videoregisterdevice" This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a. The intentions of that patch were good, but it doesn't work. The idea is that if deviceregister...

CVE-2026-89739

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...

CVE-2026-89737

In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work function dereferences those references, and can also requeue itself in it...

CVE-2026-89738

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode board.vbuspin && board.vbuspolled, probe arms a self-restarting cycle: at91vbustimer schedules vbustimerwork, and at91vbustimerwork calls...