CVE-2026-54551 WireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization)

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpointwebsocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdate...

CVE-2026-44235 rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed...

CVE-2026-44236 rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin, and rabbitmq-c accepts the value in amqplogininner in librabbitmq/amqpsocket.c. amqptuneconnection in...

CVE-2026-54546 CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL in api/routes/basemap.ts to fetchurl without resolved-address...

CVE-2026-54579 mport mirror-selection ping accepts insufficiently validated ICMP replies

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping in libmport/ping.c accepted ICMP replies without validating icmpid or icmpseq and parsed the reply using a fixed IP-header offset instead of iphl. A network attacker able to inject or spoof visible ICMP replies could influence mirror...

CVE-2026-54576 mport package installation has symlink TOCTOU in chown and chmod handling

mport is the MidnightBSD Package Manager. Prior to 2.7.8, doactualinstall in libmport/bundlereadinstallpkg.c used path-based lstat, chown, stat, and chmod operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlin...

CVE-2026-54587 mport directory asset installation is vulnerable to symlink and path traversal races

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp, ownership, and permission operations. A local attacker able to modify part of the target installation tree could use...

CVE-2026-54575 mport package fetch and clean paths are vulnerable to TOCTOU filesystem races

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

CVE-2026-8674 Assertion failure in the DNS stub resolver with a long search domain

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates...

CVE-2026-54578 mport verify can compare stale checksum data after hashing failures

mport is the MidnightBSD Package Manager. Prior to 2.7.8, mportverifypackage in libmport/verify.c could continue after MD5File or SHA256File failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed digest. An attacker able to influence an installed...

CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...

CVE-2026-54585 mport sample file handling can write outside the configured root

mport is the MidnightBSD Package Manager. Prior to 2.7.8, createsamplefile in libmport/bundlereadinstallpkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport-root. A malicious or malformed package manifest could therefore direct privileged...

CVE-2026-54580 mport index decompression can leave partial or corrupt index data after zstd failures

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...

CVE-2026-54582 mport package installation can overwrite existing unmanaged or differently owned files

mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/checkpreconditions.c, libmport/installprimative.c, and libmport/mportprivate.h did not apply...

CVE-2026-54577 mport audit can inspect the wrong package when options are present

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted localargv and localargc values but passed the original argument entry to auditpackage. When an operator or automation used an option such as -r before a package name, stale optind...

CVE-2026-54583 mport package bundle downloads allow unsafe destination filenames

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

CVE-2026-54581 mport bootstrap index fetch can continue after hash verification failure

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...

CVE-2026-28326 SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key...

CVE-2026-93296 MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

MISP contains a stored cross-site scripting XSS vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without...

CVE-2026-93292 SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute...

CVE-2026-93295 MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-85716 AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but log...

CVE-2026-93204 batman-adv: dat: atomically update mac addresses

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: atomically update mac addresses When a MAC address is updated in batadvdatentryadd, it is done using a simple copy function. A parallel reader might only see parts of this update. In worst case, the reader is...

CVE-2026-93203 batman-adv: bla: avoid CRC corruption due to parallel claim add

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid CRC corruption due to parallel claim add batadvblaaddclaim is used to add claims and modify the backbone of claims for CLAIM frames from remote backbones and local packets. When it handles a claim, it needs...

CVE-2026-93202 i3c: master: Fix recursive locking during device registration

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix recursive locking during device registration i3cmasterregisternewi3cdevs registers newly discovered devices while holding i3cbusnormaluselock, a downread. deviceregister can immediately probe the device, and prob...

CVE-2026-93201 dm-pcache: validate seg_id fields from persistent memory

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the GC worker take a cache segment id from the cache device metadata and...

CVE-2026-93199 i3c: master: Do not treat master device as a duplicate target

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Do not treat master device as a duplicate target i3cmastersearchi3cdevduplicate searches the bus for another I3C device with the same PID as the reference device. The search can match master-this, causing the...

CVE-2026-93200 i3c: master: Fix use-after-free of master->this

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix use-after-free of master-this sysfs attribute callbacks for the master controller device dereference master-this. However, master-this is freed in i3cmasterdetachfreedevs before the master device itself is...

CVE-2026-93198 dm-pcache: validate the persisted dirty_tail chain at load

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate the persisted dirtytail chain at load The writeback worker follows the persisted dirtytail chain, which is decoded from the cache device independently of the keytail chain that cachereplay walks and bounds. A...

CVE-2026-93196 nvdimm: virtio_pmem: refcount requests for token lifetime

In the Linux kernel, the following vulnerability has been resolved: nvdimm: virtiopmem: refcount requests for token lifetime KASAN reports slab-use-after-free in wakeupcommon: BUG: KASAN: slab-use-after-free in wakeupcommon+0x114/0x160 Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0...

CVE-2026-93197 memcg: move LRU size accounting on reparenting instead of copying it

In the Linux kernel, the following vulnerability has been resolved: memcg: move LRU size accounting on reparenting instead of copying it When a memory cgroup is offlined its LRU folios are reparented to the parent. lruvecreparentlru splices the child's lists into the parent's and credits the pare...

CVE-2026-93195 drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel The DisplayPort AUX channel gets initialized and registered during dwdpbind, but it is never unregistered, which may lead to resource leaks and/or use-after-free...

CVE-2026-93194 drm/rockchip: dw_dp: Release core resources

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Release core resources Core resources such as the DisplayPort AUX channel get initialized and registered during dwdpbind, but are never unregistered, which may lead to memory leaks and/or use-after-free:...

CVE-2026-93193 drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Fix OF node reference leak via auto cleanup Sashiko reported a reference leak in rockchipdpdrmencoderenable, the ofgetchildbyname function does not call ofnodeput in a symmetrical way 1. Fix the device...

CVE-2026-93192 drm/v3d: Clear queue->active_job when v3d_fence_create() fails

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Clear queue-activejob when v3dfencecreate fails The runjob callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue-activejob before calling v3dfencecreate. If v3dfencecreate fails, the callback returns NU...

CVE-2026-93191 smack: fix incorrect task context in smack_msg_queue_msgrcv

In the Linux kernel, the following vulnerability has been resolved: smack: fix incorrect task context in smackmsgqueuemsgrcv The smackmsgqueuemsgrcv function incorrectly checks the permissions of the 'current' task instead of the 'target' task. In the msgsnd syscall path, if a receiver is already...

CVE-2026-93190 platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosectypec: Reject out-of-bounds PD cap count crostypecregisterpartnerpdos copies the partner PDOs from the EC TYPECSTATUS response into the fixed capsdesc.pdoPDOMAXOBJECTS array. memcpycapsdesc.pdo,...

CVE-2026-93189 HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

In the Linux kernel, the following vulnerability has been resolved: HID: core: quiesce input in hidhwstop to prevent use-after-free A driver's probe calls hiddeviceiostart to enable input delivery, then fails at a later initialization step and unwinds via hidhwstop. The unwind frees struct hidraw...

CVE-2026-93188 HID: roccat: bound device-supplied profile index

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index konekeepvaluesuptodate and koneprofileactivated use an 8-bit, device-supplied profile value as an index into the 5-element kone-profiles array without a range check. A malicious US...

CVE-2026-93187 ASoC: SOF: ipc4-topology: Return error for invalid number of formats

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Return error for invalid number of formats When the number of input or output formats is zero, sofipc4widgetsetupcompsrc and sofipc4widgetsetupcompasrc print an error and jump to the cleanup label. At th...

CVE-2026-93186 cxl/mbox: Clamp mailbox output allocation to the payload size

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

CVE-2026-93185 ASoC: rt700-sdw: always drain jack work on remove

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt700-sdw: always drain jack work on remove rt700sdwremove drains jackdetectwork and jackbtncheckwork only when rt700-hwinit is true. That state bit is cleared by rt700updatestatus when the SoundWire slave becomes UNATTACHE...

CVE-2026-93184 ASoC: fsl_audmix: rework runtime PM handling in probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslaudmix: rework runtime PM handling in probe After pmruntimeenable the AUDMIX block is powered off and stays suspended until the first runtime resume. Register writes issued between probe and the first resume e.g. from DA...

CVE-2026-93183 drm/lima: call drm_mm_init() with a valid allocation range

In the Linux kernel, the following vulnerability has been resolved: drm/lima: call drmmminit with a valid allocation range limavmcreate is currently run before vastart and vaend are set up, meaning they are both 0. limavmcreate runs drmmminit with them as arguments for the allocator, and if...

CVE-2026-93182 sched/fair: Fix overflow in update_tg_cfs_runnable()

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

CVE-2026-93180 drm/panthor: Fix NPD issue on partial unmap of an evicted BO

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix NPD issue on partial unmap of an evicted BO This commit fixes the NULL pointer dereference issue that would have happened on the split of GPU mapping due to partial unmap of an evicted BO. There is a logic to...

CVE-2026-93181 perf/x86/intel/uncore: Fix uncore_box ref/unref ordering

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix uncorebox ref/unref ordering In uncoreeventcpuonline, uncoreboxref was called before uncorechangecontext. uncoreboxref gates on box-cpu = 0, but box-cpu is still -1 at that point because...

CVE-2026-93179 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

CVE-2026-93178 drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of...

CVE-2026-93177 drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...