PT-2026-98731

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rds conn shutdown consume a concurrent drop rds conn shutdown finishes by moving the path from RDS CONN DISCONNECTING to RDS CONN DOWN, and also accepts RDS CONN ERROR as the starting state of that final...

PT-2026-99097

Name of the Vulnerable Software and Affected Versions Ciena Navigator Network Control Suite NCS affected versions not specified Description An information exposure issue exists in an event-streaming API that fails to properly enforce authentication. An unauthenticated attacker with network access...

PT-2026-98495

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap overflow exists in the SMB client when rewriting a Discretionary Access Control List DACL. The issue occurs in the id mode to cifs acl function, which allocates a buffer based on...

PT-2026-98665

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amd iommu pdom id alloc returns an int: a domain ID on success, or the negative errno from ida alloc range when the ID space is exhausted or memory is short. amd...

PT-2026-99118

Name of the Vulnerable Software and Affected Versions Mediawiki - WikiLambda Extension version 1.47.0-alpha Description An information exposure issue in the Mediawiki - WikiLambda Extension allows unauthorized actors to perform excavation, enabling the viewing of revision-deleted pages. This occu...

PT-2026-98940

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An issue in the ticket isolation mechanism allows any authenticated agent to bypass boundaries and view sensitive data from GitHub or GitLab issues attached to any ticket in the system. By querying...

PT-2026-99010

Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these errors are...

PT-2026-98824

Name of the Vulnerable Software and Affected Versions Wellav WES Emergency Broadcast Terminal WES100 versions prior to 08-08-2023 Wellav WES Emergency Broadcast Terminal WES270 versions prior to 08-08-2023 Wellav WES Emergency Broadcast Terminal WES280 versions prior to 08-08-2023 Wellav WES...

PT-2026-98464

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mptcp receive path where, under specific error conditions, the system can recursively call the mptcp data ready function via a state change, leading to an attempt ...

PT-2026-98608

In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfi get func hash The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble. fineibt...

PT-2026-98768

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Prevent double migration of device pages A device-private folio migrated to system memory by a CPU fault can remain reachable through the raw-PFN eviction path until migration finalization drops the source reference...

PT-2026-99061

Name of the Vulnerable Software and Affected Versions TDuck survey form version 6.0 Description An information disclosure issue exists in the hasPermission function of FormAuthUtils. The system fails open when a form does not exist, which allows authenticated users to access deleted form...

PT-2026-98792

In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP CMD TIMER START The SCTP CMD TIMER START handler checks timer pending before calling timer reduce. The timer can expire and detach between these operations, causing timer reduce to rearm the timer...

PT-2026-99049

Impact An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with...

PT-2026-98628

In the Linux kernel, the following vulnerability has been resolved: ppp synctty: ensure a writeable skb header ppp sync txmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

PT-2026-98616

In the Linux kernel, the following vulnerability has been resolved: sunvdc: unmap LDC cookies when the descriptor send fails send request maps the request's pages into the LDC channel's map table ldc map sg, fills in the descriptor and marks it VIO DESC READY before ringing the doorbell via vdc t...

PT-2026-98655

In the Linux kernel, the following vulnerability has been resolved: vdpa sim blk: reject out-of-range sector starts vdpasim blk check range logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer...

PT-2026-98772

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

PT-2026-98526

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory management issue exists in the Linux kernel where the afs dir search bucket function fails to perform a kunmap operation—which unmaps a virtual address from a kernel mapping—whe...

PT-2026-98719

In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvme scan ns list drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvme find get ns to look the namespace up and...

PT-2026-98684

In the Linux kernel, the following vulnerability has been resolved: net: reject oversized tx queue len at netlink parse time rtnl create link assigns IFLA TXQLEN directly to dev-tx queue len without going through netif change tx queue len, so a device created with "ip link add ... txqueuelen...

PT-2026-98492

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfs defer finish one xfs defer finish one declares error without an initialiser and only assigns it inside the loop over dfp-dfp work. When that list is empty the loop body never runs, control falls throu...

PT-2026-98507

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Multipath TCP MPTCP implementation between the disconnect function and the retransmission rtx process. This race can lead to an inconsistent status within...

PT-2026-98607

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire init mm write lock on collapse to avoid UAF x86 implements page attribute modification using its Change Page Attributes CPA mechanism. This tracks properties of ranges such as cache mode through x86 page...

PT-2026-98389

Name of the Vulnerable Software and Affected Versions Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress versions prior to 9.6.1.1 Description An issue exists where the maybe update user role function reads a target role from a Gravity Forms entry field, configured via...

PT-2026-98930

Name of the Vulnerable Software and Affected Versions golang.org/x/playground affected versions not specified Description A malicious txtar archive can escape its execution context to force arbitrary writes to the trusted filesystem of the playground host. Additionally, a specific path used to...

PT-2026-98757

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirty lock IRQ-safe fbtft mkdirty can be reached from the fbcon rendering path while processing printk in hardirq context. Meanwhile, dirty lock is also taken by fbtft deferred io in workqueue context with...

PT-2026-98786

In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3 zero range, smb3 punch hole, smb3 insert range, and smb3 collapse range modify file contents through server-side range operations. These operations discard the...

PT-2026-98788

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOC FL ZERO RANGE is used without FALLOC FL KEEP SIZE, smb3 zero range may extend EOF without checking RLIMIT FSIZE, allowing the file to grow beyond the caller's file-size limi...

PT-2026-99009

Parse Server versions = 9.0.0 before 9.10.0 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still returned i...

PT-2026-99108

Name of the Vulnerable Software and Affected Versions RustDesk versions prior to 1.5.0 Description On Linux and macOS, the Cliprdr message handler fails to properly validate file transfer permissions for incoming file clipboard messages. This allows authenticated remote peers, even those with fil...

PT-2026-98838

Name of the Vulnerable Software and Affected Versions Seclore FileSecure Desktop Client versions prior to 3.25.1.0 Description An improper access control issue exists in the kernel-mode driver component. This allows an authenticated local user to elevate their privileges to NT AUTHORITYSYSTEM,...

PT-2026-98613

In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfs get config item treats a hashed dentry as proof that sd-s element is a live config item. configfs rmdir breaks that: simple rmdir leaves the dentry hashed, th...

PT-2026-99064

Name of the Vulnerable Software and Affected Versions GLPI versions 0.72 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An authenticated user without the necessary permissions can enable debug mode because the user-setting update process fails to enforce the privilege boundary...

PT-2026-98502

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the SMB client where tcon super cb stores a raw superblock pointer. Because cifs get super only takes an active reference after iterate supers type has dropped...

PT-2026-98727

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btf modifier show resolves the modifier and then calls btf type opst-show unconditionally. For the void type type id 0, BTF KIND UNKN kind ops has no entry, so -show is NULL. A...

PT-2026-99098

Name of the Vulnerable Software and Affected Versions Microsoft Office Outlook affected versions not specified Description An integer overflow or wraparound occurs in Microsoft Office Outlook, which could allow an unauthorized attacker to execute code remotely over a network. This issue requires...

PT-2026-98742

In the Linux kernel, the following vulnerability has been resolved: btrfs: zstd: fix lost wakeup when waiting for a workspace A writer can sleep forever in zstd get workspace even though a workspace is free. When zstd alloc workspace fails, the task is queued on zwsm-wait and schedules...

PT-2026-98385

Name of the Vulnerable Software and Affected Versions s2Member versions prior to 260829 Description Unauthenticated attackers can achieve Remote Code Execution on the server due to insufficient sanitization of the first name parameter. The plugin uses the esc refs function, which only removes reg...

PT-2026-98594

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04 last array size mismatch with in04 buf The in04 last array in struct usx2ydev is declared as char24, but in04 buf is allocated as sizeofstruct us428 ctls which is 21 bytes. In i usx2y in04 int, when ctl...

PT-2026-98557

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Check resize disabled before publishing the new subbuf order ring buffer subbuf order set stores the new order and only then walks the CPUs, returning -EBUSY if any of them has resizing disabled. A user mapped buffer...

PT-2026-98760

In the Linux kernel, the following vulnerability has been resolved: tipc: Dont send random pad bytes in RESET/ACTIVATE messages The interface name is passed in a fixed length TIPC MAX IF NAME buffer. Replace the strcpydata, l-if name with memcpy so that the pad bytes are actually written l-if nam...

PT-2026-98748

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrack insn: Handle ld abs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPF LD | BPF IND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

PT-2026-99004

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease id in one namespace could revoke a lease in another namespace when the foreign lease id was known, bypassing namespace ACL isolation. The affected lease look...

PT-2026-99130

Name of the Vulnerable Software and Affected Versions Flame versions prior to 2.4.1 Description An information exposure issue exists in the unauthenticated 'GET /api/config' endpoint, which returns the complete configuration object without redacting sensitive fields. This allows an attacker to...

PT-2026-98354

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.4 Description Incorrect authorization exists in the api/controllers/User.php file when the id variable is set to "admins" or "all". Recommendations Update to version 1.8.4 or later...

PT-2026-98658

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRING NUM larger than device max vhost vring set num accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to set vq num without comparing it with get vq num max. ...

PT-2026-98529

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 crypto implementation where the do one request callback returns a negative error code instead of 0 after a request is explicitly completed by crypto finalize...

PT-2026-98802

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the NTFS driver when the write mft record nolock function maps the MFT record folio using kmap local folio. If the pre write mst fixup or bio add folio functions...

PT-2026-98415

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/categories' endpoint, where malicious...