PT-2026-122905

These are all security issues fixed in the docker-compose-5.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-121743

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...

PT-2026-121749

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand this is expected. The /json//report API endpoint CaptureRepor...

PT-2026-121830

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...

PT-2026-121776

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output...

PT-2026-121778

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage...

PT-2026-121777

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

PT-2026-121775

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that...

PT-2026-122118

A missing authorization vulnerability in Zimbra Collaboration Suite ZCS allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the pro...

PT-2026-122117

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...

PT-2026-122119

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite ZCS allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without...

PT-2026-122114

A CSS sanitization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the fin...

PT-2026-122115

A cross-account authorization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file...

PT-2026-122116

An LDAP filter injection vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP...

PT-2026-122241

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...

PT-2026-121810

AesGcmCryptor.Open passed a caller-supplied nonce straight to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine...

PT-2026-121754

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing...

PT-2026-122230

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description In the twisted.names.dns.DNSDatagramProtocol, the system accepts UDP DNS responses for pending queries based solely on a matching 16-bit transaction ID without verifying the source host and port...

PT-2026-122153

Improper sanitization in the registration module allows reflected Cross-Site Scripting...

PT-2026-121973

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate mount busy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

PT-2026-121972

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mnt change mountpoint umount mnt resets -overmount of the parent when it unmounts the mount that overmounts it. mnt change mountpoint doesn't. It moves the mount to its new parent a...

PT-2026-122027

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio mpsse irq enable arms the poll worker before publishing it: schedule work runs before the worker is added to priv-workers. If gpio mpsse disconnect walks the list in that...

PT-2026-121968

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt notify add puts a mount on notify list. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

PT-2026-122022

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h free logical LAN on open-fail after register ibmveth open registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out free buffer pools without h free logical lan, so PHYP still owns the...

PT-2026-122049

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fib nlmsg size call for asynchronous hardware flag...

PT-2026-121962

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot root path pivot root reads the parents of new root and of the caller's root and checks whether they are shared before it checks that either mount is in the caller'...

PT-2026-121963

In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt ns release drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotify mntns delete. That takes the mutex of...

PT-2026-122037

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

PT-2026-122008

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br multicast sg del exclude ports removes automatically added STAR EXCL port groups by calling br multicast del pg. For S,G entries, that deletion calls back into br multicast s...

PT-2026-122033

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strp recv isn't running before tearing down the parser The comment above strp done claims that if strp is stopped, strp recv will no longer be called. That's only true if the caller has a mechanism eg locking...

PT-2026-122015

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx usb ms: complete requests after eject instead of dropping them memstick check can pass its host-removing check just before rtsx usb ms drv remove sets eject/removing. Its next request is then silently dropped: rtsx...

PT-2026-122011

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci sprd probe enables runtime PM, while sdhci sprd remove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the...

PT-2026-122034

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet fill frags fails When a response chain has more slots than fit in the skb's frags, xennet fill frags returns an error and xennet poll jumps to its error path. That path moves what's le...

PT-2026-122010

In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet rcv spkt packet rcv spkt restores the link layer header with skb pushskb, skb-data - skb mac headerskb; That subtraction is only meaningful when the device actually has a link layer...

PT-2026-122009

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc getname smc getname dereferences smc-clcsock without holding clcsock release lock. Link-group termination can release the CLC socket through smc close active abort while the SMC socket is...

PT-2026-121992

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hci sock bind clears hci pisk-hdev and drops the device...

PT-2026-122046

In the Linux kernel, the following vulnerability has been resolved: Input: ati remote2 - fix type confusion in device attribute handlers Previously, the channel mask and mode mask attributes were registered on the parent usb device via sysfs create group. When commit b20d6bf8014b "Input:...

PT-2026-121988

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise sco conn lifetime against sco recv scodata sco recv scodata upgrades the weak hcon-sco data back-pointer to a strong reference under hdev-lock: hci dev lockhdev; hcon = hci conn hash lookup handlehdev,...

PT-2026-121987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm recv data hands the skb to d-data ready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the...

PT-2026-121990

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso sock listen drops the socket lock before calling iso listen bis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore...

PT-2026-122045

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify dao clear left,right input functions" centralized the DAO input mapper clearing logic in dao clear input, but omitted the...

PT-2026-121884

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute depth and return -ELOOP when exceeded...

PT-2026-121892

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folio queue ENOMEM in writeback by adding a mempool" added a mempool for the folio queues and made the request, subrequest and folio...

PT-2026-121891

In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust idledly against divide-by-zero and overflow adjust idledly has several corner-case issues flagged during review: 1. If xe gt clock init failed to recognise the crystal clock, gt-info.timestamp base is 0, whi...

PT-2026-121932

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io uring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfs uring encoded data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io uring does not free driver PDU...

PT-2026-121931

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs dir item item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

PT-2026-121930

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-non aql packets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...

PT-2026-121935

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs uring read extent endio If all bios finish before btrfs encoded read regular fill pages returns, it calls btrfs uring read extent endio and previously returned the I/O status. A...

PT-2026-121929

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netif napi del locked and in page pool disable direct recycling because the driver does not disable th...

PT-2026-121934

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs uring read extent fails After btrfs uring read extent, the caller always jumped to out acct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On...