PT-2026-117048

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extra len overflow In ieee80211 rx h defragment, fragment payloads are accumulated into entry-extra len as subsequent fragments arrive: entry-extra len += rx-skb-len; When the fin...

PT-2026-117166

A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack...

PT-2026-117013

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

PT-2026-116792

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skb checksum setup ipv6 skb maybe pull tail subtracts skb headlenskb from the unsigned max argument and passes the result to pskb pull tail as a signed int. The function does not ensure th...

PT-2026-116831

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catc rx done catc rx done walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pkt len urb-actual length, ignores the header offset and compares...

PT-2026-116795

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc llcp wks sap and nfc llcp build sdreq tlv pass non-null- terminated strings to pr debug using the %s format specifier. The buffers are allocated via kmemdup o...

PT-2026-116788

In the Linux kernel, the following vulnerability has been resolved: ip gre: Reject enabling collect metadata through changelink ipgre netlink parms can enable collect md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting...

PT-2026-117065

In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV SHUTDOWN after the sendmsg connect wait sctp wait for connect drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurre...

PT-2026-117055

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6 ISO PACKETS max packet size out bytes, sized from the OUT endpoint, but the number of bytes written into that...

PT-2026-117072

In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inet gso segment or ipv6 gso segment for each nested IP header. encap level tracks header bytes, not callback depth, so a deep chain can exhaust the kernel...

PT-2026-117057

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles BUG Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fb pad aligned buffer+0x11f/0x140 Read of size 1 at addr...

PT-2026-117038

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8 MAX, and records exceeding...

PT-2026-116797

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

PT-2026-117027

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm sysport get stats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm sysport get stats. The variable 'j' tracks the compacted index into the...

PT-2026-116906

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tb xdp properties request allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can...

PT-2026-116753

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy new policy audits the policy after ipe new policyfs node publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while ipe audit...

PT-2026-117155

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This expos...

PT-2026-116538

A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder c...

PT-2026-117158

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to...

PT-2026-117610

These are all security issues fixed in the python313-OpenEXR-3.4.16-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116674

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM CONNINFO The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-sk state != BT CONNECTED && !rfco...

PT-2026-116631

Name of the Vulnerable Software and Affected Versions libspatialite versions prior to 5.1.1 Description The software fails to validate the polygon ring count within the ParseWkbPolygon function. This allows an attacker to trigger uncontrolled interior-ring allocation by providing crafted geometry...

PT-2026-116600

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1...

PT-2026-116687

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

PT-2026-116689

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvm pkvm ioctl allowed WARNs when kvm get cap for kvm ioctl doesn't find the ioctl number in vm ioctl caps, and kvm arch vm ioctl calls it for every number the gener...

PT-2026-116835

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset num napi when the napi vectors are freed fbn-num napi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnic pm suspend tears the datapath down...

PT-2026-116682

In the Linux kernel, the following vulnerability has been resolved: sched ext: Derive SCX RQ IN WAKEUP from the core enqueue flags schedule deferred locked skips scheduling a deferred action while SCX RQ IN WAKEUP is set and relies on the task woken scx call that follows a wakeup enqueue to run i...

PT-2026-116961

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client-ioctl mutex, but the translated port-info compat path invokes the same handlers through snd seq kernel client ctl...

PT-2026-116940

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending...

PT-2026-116873

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atomize IRQ register read/modify/write ops Why The OTG GLOBAL SYNC STATUS register controls various HW IRQ sources for the output timing generator OTG. VUPDATE NO LOCK is one of them. To enable the IRQ, driver se...

PT-2026-116878

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read...

PT-2026-117069

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX RING byte count overflow tpacket snd drains every SEND REQUEST frame in a TX ring and adds each valid packet length to the signed int len sum. Userspace can recycle completed frames concurrently, so a singl...

PT-2026-116535

A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit i...

PT-2026-116648

Name of the Vulnerable Software and Affected Versions @fastify/jwt versions prior to 10.2.5 Description In the top-level sign and verify methods, per-call options replace globally configured defaults instead of merging with them. This behavior causes any global default not explicitly restated in...

PT-2026-116630

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...

PT-2026-116678

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci bind bis hci conn link takes a lifetime reference to its parent with hci conn get, but only takes an operational hold on the child. hci conn unlink later balances both a hold and a...

PT-2026-116601

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create item html of the file modules/ui extra networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initia...

PT-2026-116651

A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend. init of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of...

PT-2026-116975

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3 pci probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pci set drvdata, while the second...

PT-2026-116946

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK FEAT ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path...

PT-2026-116653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A range check was missing in the proc dointvec ms jiffies minmax function within the sysctl component. This occurred because a previous update to replace the SYSCTL INT CONV CUSTOM macro...

PT-2026-116596

Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5...

PT-2026-116778

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcr port err smcr port err traverses smc lgr list.list without holding smc lgr list.lock, allowing a concurrent smc lgr terminate sched to free an lgr while it is still being dereference...

PT-2026-117040

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB HAS METADATA leaves iocb-private as a uio meta, while iocb bio iopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdev direct IO, which never publishes...

PT-2026-116848

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls u32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it...

PT-2026-116815

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6 route output flags, ip6 rt put flags, and ip6 dst check detect an uncached route by list empty&rt-dst.rt uncached, which replaced the static DST NOCACHE flag check in commit a4c2fd7f789...

PT-2026-116948

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va align to hugetlb mappings on AMD F15h get align mask returns huge page mask align for hugetlbfs, but get align bits adds va align.bits regardless, so vm unmapped area returns an address off the huge page...

PT-2026-116800

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc llcp recv dm nfc llcp recv dm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connecting sockets: it looks the socket up with nfc llcp connecting sock get...

PT-2026-117008

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free by rcu ttrace do call rcu ttrace returns early when call rcu ttrace in progress is set and leaves the objects in free by rcu ttrace. free rcu frees waiting for gp ttrace only and clears the flag...

PT-2026-117012

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpf ct set nat info is not validating the NAT manipulation type a wrong value can be passed directly to nf nat setup info. This triggers the WARN ON at nf nat setup info an...