PT-2026-98538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv4 forwarding information base fib where the fib empty table function probes every table ID starting from 1 until a free one is found. Because IPv4 tables are...

PT-2026-98564

In the Linux kernel, the following vulnerability has been resolved: drm/drm exec: fix up contended obj when num objects is 0 drm exec prepare array silently returns success without calling drm exec lock contended when num objects is zero. This breaks the invariant upheld by drm exec lock obj, whe...

PT-2026-98627

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptp lock at probe time priv-ptp lock is only initialized in stmmac ptp register, which runs during stmmac open. However, the lock is also used while the interface is down and has never been opened: tc tapr...

PT-2026-98881

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane stores an administrator-controlled custom field table value without validating it against allowed table names. The Mdl custom fields::used function later concatenates this stored...

PT-2026-99059

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software exposes appKey and appSecret credentials via the 'GET /application/manager/select' endpoint. This occurs because the endpoint lacks authentication and field filtering, allowing...

PT-2026-98542

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where fqdir pre exit flushes socket buffers skbs from incomplete queues without updating their completion state. This allows a fragment to acquire a...

PT-2026-98985

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to...

PT-2026-98485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfs module where the xfs btree bload prep block function fails to release the new bp variable if the xfs btree bload drop buf function encounters an IO error while...

PT-2026-98855

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A path traversal issue exists in the Universal Connector Oracle Wallet upload component. This allows an authenticated remote attacker to write arbitrary files to the system. Path traversal ...

PT-2026-98618

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rds message map pages assigns PAGE SIZE bytes to every scatterlist entry, even when total len ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on...

PT-2026-98793

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmac tso xmit In stmmac tso xmit, if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped befo...

PT-2026-98416

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/categories' endpoint, where malicious...

PT-2026-98366

Name of the Vulnerable Software and Affected Versions Fancy Product Designer versions prior to 6.5.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs when the fpd save order AJAX action, registered...

PT-2026-98726

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btf var show btf var show calls btf type id resolve unconditionally, which dereferences btf-resolved ids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpf snprintf btf renders against - since...

PT-2026-98577

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure cmd stream ends with a stop op While the QSIZE register setting should prevent an out of bounds access of the command stream, it is not clear whether the h/w generates an interrupt in this case as is require...

PT-2026-98676

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq pie: clamp quantum in change path fq pie change accepts any quantum value from userspace, including 1. With a crafted size table qdisc pkt len reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 time...

PT-2026-98421

Name of the Vulnerable Software and Affected Versions lazy html versions 0.1.0 through 0.1.12 Description An issue exists where improper neutralization of input during web page generation allows mutation Cross-site Scripting XSS. This occurs during a parse and serialize round-trip of...

PT-2026-98936

Name of the Vulnerable Software and Affected Versions zhistaredu StarTraining versions prior to 3.8.2 Description A security flaw exists in the api-docs endpoint within the SecurityConfig.java file. A manipulation of an unknown function in this component allows a remote attacker to bypass...

PT-2026-98978

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

PT-2026-98660

In the Linux kernel, the following vulnerability has been resolved: virtio: fix use-after-free in unregister virtio device device unregister is device del plus put device. When the caller holds no extra reference, that drops the last one and runs the release callback, which for several transports...

PT-2026-98775

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

PT-2026-98687

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folio put after error dmb-cpu addr was allocated via folio alloc. Use folio put instead of kfree in the error exit of ism alloc dmb to avoid slab allocator corruption. While at it, reset dmb-cpu addr after folio put to...

PT-2026-98988

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...

PT-2026-98761

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipc named node up on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

PT-2026-98753

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfs init new device switches latest dev and possibly s bdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or...

PT-2026-98584

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails print entries uses n entries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails...

PT-2026-99085

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description When the "Automatic account link on initial logon" setting is enabled, the system binds an incoming third-party Single Sign-On SSO identity to an existing local account by matching the reported email...

PT-2026-98941

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description In the inbound PGP email processing, the return value of the gpg verification call is silently discarded. The handler unconditionally marks the security preferences of the article as having a successf...

PT-2026-98806

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the amdxdna cmd set error function. The function retrieves the first Buffer Object BO of a command chain, which increments its reference count. If the subseque...

PT-2026-98809

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the printk component where the system incorrectly triggers a warning upon the failure of the kthread run function. This occurs because the kthread create on node...

PT-2026-98504

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the cifs.idmap key descriptions contain authority-bearing fields, such as owner and group SIDs and uid/gid values in "os:", "gs:", "oi:", and "gi:...

PT-2026-98523

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the AFS component of the Linux kernel. The function afs fs probe fileserver fails to properly preserve the old address list when fetching the curren...

PT-2026-98549

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nf ct set timeout protects the timeout hook dereference and policy lookup with rcu read lock. cttimeout exit, however, unregisters the per-net operations before it clears the...

PT-2026-98892

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description The check upgrade access rights function in admin/include/functions upgrade.php conditionally escapes the submitted username only if the get magic quotes gpc function exists. In PHP 8 and later, wher...

PT-2026-98413

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/serial-number-types' endpoint, where...

PT-2026-98369

Name of the Vulnerable Software and Affected Versions Gutenverse versions prior to 4.0.9 Description The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can...

PT-2026-98550

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix uninitialized return value in netfs unbuffered write If preparation of the first subrequest fails, netfs unbuffered write exits its loop before ret is initialized. The empty-iterator check can do the same. For...

PT-2026-98481

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ath9k htc wifi driver where usb device id is stored. Because of the presence of dynamic IDs, usb device id is not guaranteed to remain valid beyond the probe phase...

PT-2026-99107

Name of the Vulnerable Software and Affected Versions pgPointcloud versions prior to 1.2.6 Description An issue exists in the dimensional patch WKB Well-Known Binary deserialization process. Authenticated database users can exploit this by providing crafted pcpatch values with manipulated size...

PT-2026-98711

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpf fastcall patterns entered by a jump mark fastcall pattern for call must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf remove...

PT-2026-98320

Name of the Vulnerable Software and Affected Versions Lemonldap::NG::Portal versions 2.23.0 through 2.23.3 Description An issue exists where public Relying Parties in PKCE or secret mode can bypass Proof Key for Code Exchange PKCE, a security extension for OAuth 2.0 that prevents authorization co...

PT-2026-98918

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.17 RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description The JWKS key fetching mechanism in...

PT-2026-98533

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the iova to phys function when using a 5-level translation table via ZPCI TABLE TYPE RFX. This happens because the get rto from iova function fails t...

PT-2026-98575

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register...

PT-2026-98894

Name of the Vulnerable Software and Affected Versions FriendsOfFlarum OAuth versions prior to 1.7.4 FriendsOfFlarum OAuth versions prior to 2.0.0-beta.4 Description An account takeover issue exists when the Discord OAuth provider is enabled. The provider fails to check the verified field of the...

PT-2026-98886

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description The Users::change password function fails to perform an object-level authorization check when processing a user id provided via the URL. This allows an authenticated secondary administrator to...

PT-2026-98381

Name of the Vulnerable Software and Affected Versions WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters versions prior to 4.9.9 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above t...

PT-2026-98467

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the scsi qla2xxx driver where the fcport-unsol ctx head list is modified from multiple contexts without a common lock. Entries are added via the qla2xxx process purls...

PT-2026-98461

Name of the Vulnerable Software and Affected Versions Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 Description A GraphQL query injection issue exists in the export-status component within the get export status function in src/export manager.py. The export id variable, which is an unvalidat...

PT-2026-98900

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description An issue exists in the AMQP 1.0 HTTP-over-AMQP management endpoint GET...