CVE-2026-93245

The Linux kernel contains a vulnerability in AppArmor where list heads are not properly initialized if a profile creation fails before policy_init completes. This lack of initialization causes profile_free() sanity checks to trigger a splat (kernel crash). The issue specifically affects the fail ...

CVE-2026-79760

The web-based server management platform Termix versions 2.5.0 through 2.5.1 is vulnerable to an authenticated blind SSRF via the notification channel test endpoint. The root cause is a lack of destination allowlisting or private-address blocking in src/backend/database/routes/alert-rules-routes....

CVE-2026-93425

Dokploy, a self-hostable Platform as a Service (PaaS), is vulnerable to Authenticated OS Command Injection in the patch.readRepoDirectories tRPC procedure prior to version 0.29.13 . The root cause is the lack of safe argument quoting when the user-controlled repoPath value from apps/dokploy/serve...

CVE-2026-97226

A path traversal vulnerability exists in DbGate versions up to 7.2.5 and 7.3.1-premium-beta.1. The flaw is located within the files-style Endpoint component, specifically in the fs.readFile function of the packages/api/src/controllers/files.js file. By manipulating the filePath/uri argument, an a...

CVE-2026-76907

The LaSuite Doc platform (versions 4.8.2 through 5.4.0) is vulnerable to public document enumeration via the GET /api/v1.0/documents/search/ endpoint. The root cause is that the API accepts sequential seven-digit document paths to scope searches without requiring the public document UUID. An unau...

CVE-2026-93244

The Linux kernel contains a vulnerability within the drm/sysfb: simpledrm component related to insufficient stride validation. The issue is addressed by validating the computed stride against the maximum value INT_MAX . No specific exploit details, impact metrics, or in-the-wild exploitation info...

CVE-2026-93243

The Linux kernel contains a vulnerability in secretmem where unevictable folios were not correctly accounted for under the RLIMIT_MEMLOCK limit. Because these folios remained unevictable even after being unmapped (relying on AS_UNEVICTABLE rather than PG_mlocked ) and were not included in a proce...

CVE-2026-93242

The Linux kernel contains a vulnerability in the scsi: qla2xxx driver related to response queue over-consumption in the __qla_consume_iocb() function. Specifically, qla24xx_process_response_queue() advances the ring_ptr past the head IOCB before dispatching; however, __qla_consume_iocb() loops pu...

CVE-2026-93241

The Linux kernel contains a vulnerability in memcg where dying tasks can bypass reclaim and the oom killer once the oom_reaper has finished its task. This occurs because the oom_reaper is a best-effort, one-shot process; if it fails to acquire the mmap_lock in read mode (e.g., due to a sibling th...

CVE-2026-93240

The Linux kernel includes a fix for the memcg subsystem to make the v1 soft limit knob inert. The v1 soft limit was deprecated in version v6.12 ; the update decouples the interface from the implementation by ignoring writes to memory.soft_limit_in_bytes and reporting the maximum value on read. Th...

CVE-2026-93239

The Linux kernel (arm64 architecture) contains a vulnerability in the mm subsystem related to the lockless page-table walk in show_pte() . Because show_pte() walks page tables without holding locks and can run with interrupts enabled, a concurrent teardown can free a table page during the walk. A...

CVE-2026-93238

The Linux kernel contains a vulnerability in the s390/vfio-ap component where the apm_filtered bitmap is allocated on the stack using the DECLARE_BITMAP macro without being zero-initialized. In the vfio_ap_mdev_hot_plug_cfg() function, if a hot plug configuration change only adds control domains ...

CVE-2026-93237

The Linux kernel is affected by a vulnerability in the LoongArch architecture where the lack of a DIRECT_MAP_PHYSMEM_END definition causes the system to use a non-adaptive compile-time constant. On CPUs with fewer physical address bits than MAX_PHYSMEM_BITS (such as the Loongson-2K series ), this...

CVE-2026-63630

BentoPDF , a self-hostable client-side PDF toolkit, is vulnerable in versions 2.8.6 and earlier due to a lack of validation in the deserializeWorkflow() function. The application accepts an unvalidated tsaUrl control from imported JSON files. When a user processes a crafted workflow against a PDF...

CVE-2026-93236

The Linux kernel contains a NULL pointer dereference vulnerability within the media: meson: vdec component. When the VIDIOC_TRY_FMT command is invoked with an unsupported pixel format on the OUTPUT queue , the function vdec_try_fmt_common() attempts to fall back to V4L2_PIX_FMT_MPEG2 . In distrib...

CVE-2026-93235

The Linux kernel f2fs filesystem contains a vulnerability where extending a file size across an unaligned EOF boundary (via truncate , fallocate , or write ) could fail to zero out post-EOF data in the partial page. This flaw could expose stale disk data after a remount or crash recovery. The fix...

CVE-2026-93234

A vulnerability exists in the Linux kernel 's drm/gud component where the gud_connector_add_tv_mode() function fails to validate that TV mode names returned via the GUD protocol are NUL-terminated. Because the protocol uses fixed-size entries, a device returning a name without a terminating NUL b...

CVE-2026-93233

The Linux kernel contains a vulnerability in the drm/nouveau/dmem component where a large (compound) device-private folio split causes a callocated underflow . Specifically, while nouveau_dmem_folio_free() decrements chunk->callocated for every freed folio, the nouveau_dmem_folio_split() hook ...

CVE-2026-93232

The Linux kernel contains a vulnerability where certain configurations cause a boot panic . The issue stems from incorrect initialization ordering in mm/hugetlb ; specifically, shared tail pages for HVO (Huge Page Overlays) were initialized too late in hugetlb_vmemmap_init() while bootmem HugeTLB...

CVE-2026-93231

The Linux kernel contains a vulnerability in the lockd component where the nlmsvc_match_ip() function uses swapped arguments. When releasing locks by server IP address via /proc/fs/nfsd/unlock_ip , the function incorrectly compares a struct sockaddr as a struct nlm_host, leading it to read garbag...

CVE-2026-93230

The Linux kernel contains a vulnerability in mm/hugetlb where gigantic bootmem HugeTLB pages are initialized too late during the boot process. Specifically, these pages are initialized via hugetlb_init(), but page_alloc_init_late() runs earlier and walks pageblocks to determine zone contiguity. I...

CVE-2026-93229

The Linux kernel is affected by a vulnerability in the nfsd component. Specifically, the hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit() lacks a read memory barrier (smp_rmb) before its second counter check. On weakly-ordered architectures such as ARM and POWER , the CPU may...

CVE-2026-93228

The Linux kernel contains a vulnerability in svcrdma where a peer can send a Write or Reply chunk with a segcount field of zero. The xdr_check_write_chunk() function fails to reject these zero-count chunks because it only checks for values exceeding rc_maxpages. This allows malformed chunks to be...

CVE-2026-93227

The Linux kernel contains a vulnerability in deferred_grow_zone() when CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled. With a large CMA reservation , the function may initialize the memory map of an entire zone; however, if the node's RAM end is not aligned on PAGES_PER_SECTION boundaries, the updat...

CVE-2026-93226

The Linux kernel contains a race condition in the ipv6 networking stack. The function rt6_nh_dump_exceptions() improperly uses hlist_for_each_entry() to iterate over RCU-protected exception lists . Because the caller holds rcu_read_lock() but fails to hold rt6_exception_lock, the function rt6_ins...

CVE-2026-96873

The Mediawiki - CirrusSearch extension is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to the improper neutralization of input during web page generation. This issue specifically affects versions through 1.46.0 . While the CVSS 4.0 score indicates a Medium severity with ...

CVE-2026-77581

BentoPDF, a self-hostable client-side PDF toolkit, contains a Server-Side Request Forgery (SSRF) vulnerability in the cloud/cors-proxy-worker.js component (versions 2.8.6 and earlier ). The root cause is a DNS-based hostname allowlist bypass where the isPrivateOrReservedHost() function validates ...

CVE-2025-32000

The HCL Sametime application is vulnerable to insufficient input sanitization due to the improper sanitization of user input. This flaw allows malicious actors to leverage implicitly or explicitly trusted input to target the application. Impacted versions are addressed in HCL Sametime 12.0.4 . It...

CVE-2026-93225

The Linux kernel contains a vulnerability in the fsl-imx8mq-usb phy driver where a typec switch leak occurs during the probe error path. Specifically, if imx95_usb_phy_get_tca() succeeds but the subsequent probe fails, the switch leaks because the cleanup path was only located in .remove(), which...

CVE-2026-93224

The Linux kernel contains a vulnerability in the svcrdma component where svc_rdma_accept() fails to properly handle the error path when rpcrdma_rn_register() has not succeeded. Because svcxprt_rdma is kzalloc'd, the cleanup block unconditionally calls rpcrdma_rn_unregister, causing it to xa_erase...

CVE-2026-93223

The Linux kernel contains a vulnerability in the tegra-video media driver. Specifically, the tegra_vip_channel_of_parse() function incorrectly handles reference counting by initializing np from dev->of_node without taking a reference, while its error paths proceed to call err_node_put(). This ...

CVE-2026-93222

The Linux kernel contains a vulnerability where the send_signal_locked() function rewrites sender IDs for the target namespace. Because group sends reuse the same siginfo structure, one recipient can inadvertently affect the next. The issue is resolved by copying the siginfo before modification. ...

CVE-2026-56739

Logto versions prior to 1.43.0 are vulnerable to Server-Side Request Forgery (SSRF) because the application fails to validate outbound destinations controlled by administrators. Specifically, Webhook delivery in packages/core/src/libraries/hook/utils.ts can access cloud metadata addresses. Additi...

CVE-2026-63203

In Logto versions 1.31.0 through 1.42.0 , a vulnerability exists in the Account API handlers located in packages/core/src/routes/account/third-party-tokens.ts. The root cause is that the handlers authenticate users but fail to require the identities scope , allowing callers with only an openid sc...

CVE-2026-67233

The messaging and streaming broker RabbitMQ is vulnerable to an authorization bypass in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 . When both the rabbitmq_shovel and rabbitmq_shovel_management plugins are enabled, a user with a monitoring tag can perform unauthorized state-chang...

CVE-2026-93221

The Linux kernel is vulnerable to a race condition in the nfsd component due to a lack of serialization when accessing boolean fields in nfsd_net. Specifically, the nfsd4_end_grace() function uses a plain boolean for grace_ended, allowing concurrent paths—such as the laundromat path and the RECLA...

CVE-2026-93220

The Linux kernel contains a vulnerability in sched_ext where the kick_sync_wait_bal_cb() function incorrectly assumes it always executes on the request queue's (rq ) own CPU. Because the rq lock can be dropped while the callback is queued, it may be executed on a foreign CPU . This leads to compa...

CVE-2026-93219

The Linux kernel contains a vulnerability in the clocksource/drivers/timer-sun4i component. The sun4i_clkevt_next_event() function compensates for timer synchronization delays by programming an interval that allows for a zero-tick interval when the clockevents core calls set_next_event() with evt...

CVE-2026-93218

The Linux kernel contains a vulnerability in the mm/huge_memory component related to how it handles device-private Page Middle Directories (PMDs). A race condition occurs when an HMM-based GPU driver interacts with madvise(MADV_FREE). Specifically, migrate_vma_pages() can flip a PMD to a device-p...

CVE-2026-93217

The Linux kernel contains a vulnerability in mm/madvise where madvise_cold_or_pageout_pte_range() can trigger a kernel panic. The issue occurs because pmd_is_huge() returns true for device-private PMDs, causing a VM_BUG_ON() assertion to trip when the PMD is not present. This is potentially trigg...

CVE-2026-93216

The Linux kernel contains a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in mm/page_owner. The function print_page_owner_memcg() initially reads page->memcg_data but subsequently re-reads it locklessly in page_memcg_check(page) and PageMemcgKmem(page). If a page is concurrently freed an...

CVE-2026-93215

The Linux kernel contains a double free vulnerability within the cdx component. Specifically, in the cdx_create_res_attr() function, a failure during sysfs_create_bin_file() leads to res_attr being freed without setting cdx_dev->res_attr[num] to NULL . This leaves a dangling pointer in the arr...

CVE-2026-93213

The Linux kernel contains an out-of-bounds read vulnerability in the of_alias_scan() stem parser. The flaw occurs because the parser evaluates isdigit(*(end - 1)) before verifying that end > start. This logic error causes the system to read one byte before the property name when the name is em...

CVE-2026-93214

A deadlock vulnerability exists in the Linux kernel within the usb gadget f_tcm component. The issue occurs in usbg_make_tpg() because it holds the dep_lock while calling configfs_depend_item_unlocked(), which acquires the configfs root inode lock. This creates a circular lock dependency with con...

CVE-2026-93212

A vulnerability exists in the Linux kernel nfsd service where a NULL pointer dereference occurs in nfsd_file_net_dispose(). During per-net teardown, nn->nfsd_serv is cleared before the filecache laundrette is shut down. This allows the service thread to execute a dispose pass that identifies e...

CVE-2026-93211

The Linux kernel contains a vulnerability in the nfsd component where the DRC hash table is not fully initialized before the shrinker is registered. On weakly-ordered architectures such as arm64 and ppc , a shrinker scan can observe the drc_hashsize before the bucket list heads are initialized, r...

CVE-2026-93210

The Linux kernel contains a vulnerability in the SMB client component where the DFS cache is not properly hardened against invalid target hints. Specifically, the get_tgt_name() function returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, while dfs_cache_noreq_update_tgthint() incorrectly assum...

CVE-2026-93209

The Linux kernel contains a vulnerability in the Bluetooth hci_core component where BT enable fails intermittently with -ETIMEDOUT (-110) . The root cause is that hci_send_cmd_sync() uses skb_clone() to copy a sent command into hdev->req_skb ; under memory pressure, this clone operation fails,...

CVE-2026-93208

The Linux kernel contains a race condition in KASAN involving cache shrinking and CPU hotplug . Specifically, kmem_cache_shrink() fails to hold the cpus_read_lock(), allowing a race where objects are moved to a CPU's shrink_qlist just before that CPU goes offline. Because the offline CPU's list i...

CVE-2026-93207

The Linux kernel is affected by a SUNRPC vulnerability where the svcauth_gss_decode_credbody() function fails to properly clear the rpc_gss_wire_cred field before decoding. Because this storage is reused across requests, early decode failures leave partially decoded states mixed with residues fro...