PT-2026-117199

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe...

PT-2026-118057

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

PT-2026-117650

Name of the Vulnerable Software and Affected Versions UpdateHub affected versions not specified Description The UpdateHub firmware-over-the-air client contains a flaw in how it parses CoAP probe responses using the Zephyr JSON library within the z impl updatehub probe function. When a response...

PT-2026-122238

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.19 Wasmtime versions prior to 48.0.7 Wasmtime versions prior to 49.0.4 Description The Cranelift compiler backend on aarch64 can incorrectly compile a Wasm br table instruction when it contains more than...

PT-2026-117301

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2...

PT-2026-118017

Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2...

PT-2026-117377

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4...

PT-2026-122237

Name of the Vulnerable Software and Affected Versions Wasmtime versions 46.0.0 through 48.0.6 Wasmtime versions 49.0.0 through 49.0.3 Description A flaw exists when lowering a host-created component-model stream or future into a guest. The system may omit a required payload-type check after the...

PT-2026-118084

Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha...

PT-2026-117558

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

PT-2026-117554

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

PT-2026-118247

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.26.10 Go versions prior to 1.27.3 webpki-roots versions prior to 1.0.10 Description Eight intermediate CA certificates from eMudhra were compromised due to a flawed key-generation ceremony using a FIPS 140-2 Level 3 HSM....

PT-2026-117651

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The OSDP Control Panel reply parser cp decode response in subsys/mgmt/osdp/src/osdp cp.c fails to properly validate the payload length for REPLY KEYPPAD and REPLY RAW reply types. An attacker...

PT-2026-117587

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description A severe issue has been disclosed affecting Microsoft Edge, with reports of elevated activities targeting this flaw. Recommendations At the moment, there is no information about a newe...

PT-2026-117670

Name of the Vulnerable Software and Affected Versions Pillow versions 8.1.0 through 12.x Description Pillow contains an out-of-bounds read issue when decoding certain malformed compressed TIFF files. The problem occurs in the decodeTile and decodeAsRGBA functions within src/libImaging/TiffDecode....

PT-2026-122236

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.19 Wasmtime versions 37.0.0 through 42.x Description The Cranelift compiler backend in Wasmtime bit-packs SSA Static Single Assignment value indices. In release builds, these indices can silently overflow when...

PT-2026-117223

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load word2vec as vocab tensor of the file hanlp/utils/torch util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely...

PT-2026-130315

TuxCare rebuilt @babel/helper-plugin-utils to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-118085

containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd...

PT-2026-120338

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...

PT-2026-116662

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the xlog recover iunlink bucket function within the XFS file system of the Linux kernel. The flaw involves improper cursor and pointer handling during the recovery of...

PT-2026-116671

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open cached dir sends CREATE and QUERY INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

PT-2026-116672

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2 open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2 parse contexts rejects malformed context data, SMB2 open...

PT-2026-116674

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM CONNINFO The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-sk state != BT CONNECTED && !rfco...

PT-2026-116683

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the RISC-V KVM implementation during vCPU teardown. The non-Sstc hrtimer callback clears the next set variable before its final uses of the enclosing vCPU. If...

PT-2026-116692

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

PT-2026-116704

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the netfilter ip6t rt module. The rt mt6 check function allows rules to be configured with rtinfo-addrnr set to 0 even when address matching IP6T RT FST...

PT-2026-116717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev entry reference leak in mlx5 tc ct shared counter get When the reverse entry is found but its counter is already being released, refcount inc not zero fails and the reference taken by mlx5 tc ct entry get is nev...

PT-2026-116750

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6 ATTR DST In seg6 genl policy, SEG6 ATTR DST is defined with .type = NLA BINARY and .len = sizeofstruct in6 addr. For NLA BINARY, .len only enforces the maximum payload length and...

PT-2026-116751

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 implementation where the ipv6 find hdr function fails to verify if the calculated offset of an extension header chain exceeds the total packet length skb-len...

PT-2026-116755

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup offline cgwbs workfn drains a dying cgwb by calling cleanup offline cgwb until it returns false, with a cond resched between passes. On a CONFIG PREEMPTION...

PT-2026-116764

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata scsi set passthru sense fields trusts it...

PT-2026-116767

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the SCTP implementation of the Linux kernel. When an association is in the COOKIE-ECHOED state and a peer sends a bundled packet containing an ERROR Stal...

PT-2026-116772

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofs kill sb When autofs fill super fails before clearing AUTOFS SBI CATATONIC for example, when find get pid fails on an invalid pgrp mount option, or when an fs context is closed...

PT-2026-116773

In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom in vlan dev hard header Callers that only reserve ETH HLEN or less such as llc alloc frame, or skbs allocated before dynamic device/headroom changes e.g. toggling VLAN FLAG REORDER HDR or...

PT-2026-116787

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan na create samples LL RESERVED SPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan changelink can update needed headroom betwee...

PT-2026-116792

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skb checksum setup ipv6 skb maybe pull tail subtracts skb headlenskb from the unsigned max argument and passes the result to pskb pull tail as a signed int. The function does not ensure th...

PT-2026-116810

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb pointer if linear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. Th...

PT-2026-116817

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6 insert exception for dying fib6 info. Before the cited commit, fib6 nh flush exceptions always set from-exception bucket flushed = 1 under rt6 exception lock to prevent rt6 insert exception from inserting a new...

PT-2026-116829

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch hfsc: bound the classify inner-filter walk with a drift budget hfsc classify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a...

PT-2026-116853

In the Linux kernel, the following vulnerability has been resolved: scsi: sd zbc: Reject disks with too many zones sd zbc read zones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr zones field of struct zoned disk info, silently truncating counts...

PT-2026-116862

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rtt min in sock ops A sockops prog reading skops-rtt min never checks the sk type: on the tcp conn request path sock ops-sk is a request sock non-full, and the ctx rewrite casts it to a tcp sock ful...

PT-2026-116863

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htab map lookup and delete batch htab map lookup and delete batch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPF MAP LOOKU...

PT-2026-116879

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. num sampling freq avail is initialized to th...

PT-2026-116891

In the Linux kernel, the following vulnerability has been resolved: iio: adc: stm32-adc: fix possible division by zero in processed channel In case the conversion has failed or returned zero, processing val can lead to a division by zero. Need to check for errors, or converted value is zero, befo...

PT-2026-116919

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info-band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee80211 8023 xmit does not set info-band from the channel context on non-MLD interfaces. It stays at 0, so ieee80211 get tx rates uses the...

PT-2026-116935

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 i...

PT-2026-116936

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

PT-2026-116962

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream config-type stream config is not initialized before being passed to sdw stream add slave. The type field may contain garbage and is later copied to stream-type by sdw config...

PT-2026-116967

In the Linux kernel, the following vulnerability has been resolved: serial: 8250 bcm7271: fix use-after-free in brcmuart remove brcmuart handle irq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart hrtimer fu...