PT-2026-116772

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofs kill sb When autofs fill super fails before clearing AUTOFS SBI CATATONIC for example, when find get pid fails on an invalid pgrp mount option, or when an fs context is closed...

PT-2026-116776

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve can send tso for UDP GSO gve can send tso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in...

PT-2026-117009

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perf event exit task and perf pending task A race condition exists between perf event exit task and perf pending task during begin new exec. During begin new exec, perf event exit task may be called, and th...

PT-2026-117598

These are all security issues fixed in the ansible-core-2.21.5-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117611

These are all security issues fixed in the python313-vllm-0.32.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117604

These are all security issues fixed in the forgejo-17.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117160

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the...

PT-2026-116913

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

PT-2026-116818

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack slot obj get spi bpf get spi computes -off - 1 / BPF REG SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot...

PT-2026-117041

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211 build hdr, ieee80211 lookup ra sta uses sta info get bss for all AP and AP VLAN frames, not only for control port...

PT-2026-116917

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload fils encrypt assoc req accepts a ReAssociation Request frame whose last element is the FILS Session element. crypt len is then zero and aes siv encrypt is called with ...

PT-2026-116723

In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

PT-2026-117600

These are all security issues fixed in the ansible-core-2.19-2.19.14-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117597

These are all security issues fixed in the ab-av1-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116936

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

PT-2026-116622

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf accessor unpack floats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory,...

PT-2026-116989

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct f midi2 usb config have the size of MAX CABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries f...

PT-2026-116701

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc llcp recv hdlc nfc llcp recv hdlc reads the sequence byte skb-data2, via nfc llcp ns/nfc llcp nr, before any length check. The receive path only guarantees the two-byte LLCP header -...

PT-2026-116606

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create...

PT-2026-116634

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model name. Attackers can register a persisted custom model through POST /v1/model registrations/model type with...

PT-2026-117088

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of the argument topicid results in sql injection. The attack...

PT-2026-116948

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va align to hugetlb mappings on AMD F15h get align mask returns huge page mask align for hugetlbfs, but get align bits adds va align.bits regardless, so vm unmapped area returns an address off the huge page...

PT-2026-116558

Name of the Vulnerable Software and Affected Versions PickPlugins Product Designer for WooCommerce WordPress plugin versions prior to 1.0.41 Description The plugin fails to perform capability checks and implements inverted nonce verification, which means it accepts requests with an invalid or...

PT-2026-116651

A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend. init of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of...

PT-2026-116629

OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept and...

PT-2026-116941

In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erase size is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add device then evaluates if size % erase size with a zero divisor, which triggers a...

PT-2026-116859

In the Linux kernel, the following vulnerability has been resolved: HID: amd sfh: Validate PCI BAR size before mapping The amd sfh driver maps PCI BAR 2 using pcim iomap regions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMD P2C MSG3 at 0x1068C. However, the driver...

PT-2026-116836

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn-napiidx % fbn-num napi; The issue is this is only correct in the cases where there ar...

PT-2026-116765

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZR EL0 writes to EL2 init el2 fgt2 writes one mask to both HDFGRTR2 EL2 and HDFGWTR2 EL2. PMZR EL0 is write-only, so its trap bit, nPMZR EL0, exists only in HDFGWTR2 EL2 and is therefore never se...

PT-2026-116823

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn bind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

PT-2026-117042

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211 update assoc bss entry can pass such an entry to cfg80211 update known b...

PT-2026-116817

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6 insert exception for dying fib6 info. Before the cited commit, fib6 nh flush exceptions always set from-exception bucket flushed = 1 under rt6 exception lock to prevent rt6 insert exception from inserting a new...

PT-2026-116838

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnl lock for the ioctl self test An offline self test that brings the interface down and back up with netif close / netif open requires rtnl lock for both. Since the ethtool IOCTL path became rtnl-optional for...

PT-2026-116864

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwing init ff passes the driver's private data, allocated with devm kzalloc in winwing probe, as the effect context to input ff create memless. The memoryless...

PT-2026-116910

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tb stop only tears down DMA tunnels so a DP tunnel that is still waiting for dprx work to complete keeps that work queued while the routers are removed and the...

PT-2026-116820

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel pcie: validate device-supplied DMA indices In btintel pcie msix rx handle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbd tag a 16-bit field...

PT-2026-116821

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bnep rx frame and bnep ctrl frame net/bluetooth/bnep/core.c, use ps...

PT-2026-116825

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtio gpu vram create errors virtio gpu vram create frees the object with a bare kfreevram on both error paths after drm gem private object init has run, and on the second one after drm gem...

PT-2026-116840

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue remcsum passes them to skb remcsum process, whose partial path stores offset - start in the u16 skb-csu...

PT-2026-116873

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atomize IRQ register read/modify/write ops Why The OTG GLOBAL SYNC STATUS register controls various HW IRQ sources for the output timing generator OTG. VUPDATE NO LOCK is one of them. To enable the IRQ, driver se...

PT-2026-116886

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clk init data and clk parent data The clk init data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drive...

PT-2026-116991

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach or first open and stopped at disconnect or last close,...

PT-2026-116506

A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. T...

PT-2026-116623

Name of the Vulnerable Software and Affected Versions cgltf versions prior to 1.16 Description A heap out-of-bounds read occurs in the cgltf accessor unpack floats function when the sparse values cursor is advanced by the base bufferView byteStride. An attacker can provide a specially crafted glT...

PT-2026-116998

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acp hw init registers ACP child devices with mfd add devices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domai...

PT-2026-116373

Name of the Vulnerable Software and Affected Versions BSK PDF Manager versions prior to 3.8.2 Description Authenticated users with contributor-level access and above can perform SQL injection attacks due to improper sanitization and escaping of a parameter used in a SQL statement. This issue occu...

PT-2026-116354

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions prior to 2.12.5 Description The Welcart e-Commerce plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with editor-level access or higher can append malicious SQL queries to existing ones due...

PT-2026-116352

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description An unauthenticated attacker can perform PHP Object Injection by sending untrusted input through the checkout-email request parameter during the checkout AJAX action. The input is processed by...

PT-2026-116366

Name of the Vulnerable Software and Affected Versions PeachPay — Payments & Express Checkout for WooCommerce versions prior to 1.120.70 Description The plugin fails to perform capability or ownership checks before returning an order's secret key in response to an unauthenticated request. This...

PT-2026-116372

Name of the Vulnerable Software and Affected Versions ACF Frontend Admin by DynamiApps versions prior to 3.29.14 Description The plugin fails to restrict the PHP classes that can be instantiated during the deserialization of stored post content rendered on public pages. This allows high-privilege...