PT-2026-121978

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe i2c notifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xe i2c client work then...

PT-2026-122093

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the...

PT-2026-122000

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from of regulator bulk get all of regulator bulk get all allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c...

PT-2026-122111

The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — includin...

PT-2026-121955

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. do umount refuses to unmount locked mounts but shrink submounts doesn't. A shrinkable mount...

PT-2026-121921

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm bo handling in remap When a map overlaps part of an existing mapping, pvr vm gpuva remap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

PT-2026-121893

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl do mkdir debug print ovl do mkdir prints the input dentry with %pd after vfs mkdir. Since commit fe497f0759e0 "VFS: change vfs mkdir to unlock on failure.", vfs mkdir calls end creating on the input dentry on...

PT-2026-121944

In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch ktls: disable softirqs around tid list erases chcr ktls cpl act open rpl inserts into tid list from the receive path using xa insert bh. The array is shared by the adapter's connections and initialized with XA FLAGS LOCK...

PT-2026-122115

A cross-account authorization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file...

PT-2026-121976

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned link entry when fb-pin performs the final unpin xe bo pin external and xe bo unpin external maintain the bo's pinned link list membership in xe-pinned.late.external, based on whether the current call is t...

PT-2026-122133

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

PT-2026-122036

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

PT-2026-121981

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvr mmu op context create, but the preallocation...

PT-2026-121882

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd seq oss read checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted...

PT-2026-122055

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual wq head is not advanced...

PT-2026-121847

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgic v4 enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic domain” is NULL and the...

PT-2026-122010

In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet rcv spkt packet rcv spkt restores the link layer header with skb pushskb, skb-data - skb mac headerskb; That subtraction is only meaningful when the device actually has a link layer...

PT-2026-121830

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed...

PT-2026-121897

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied seq double-counting When a BPF stream verdict program redirects an skb back to the same socket self-redirect with BPF F INGRESS, sk psock verdict apply calls tcp eat skb which advances tcp...

PT-2026-122048

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fib alias hw flags set siz...

PT-2026-121881

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2 switch rx In case of an error in dpaa2 switch rx, the dpaa2 switch free fd function is called in order to free the FD. This is incorrect since the dpaa2 switch free fd is intended to be...

PT-2026-121952

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to i disk size, xmi can exchange reflink flags assumes every mapping moved and hands the reflink flag over to the other...

PT-2026-121941

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...

PT-2026-121866

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb domain remove. For example if user unloads the driver while at the same...

PT-2026-121962

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot root path pivot root reads the parents of new root and of the caller's root and checks whether they are shared before it checks that either mount is in the caller'...

PT-2026-122029

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE LABELS on already-initialized sb in set mnt opts When an NFSv4 filesystem exported with security label is mounted a second time, sget fc returns the existing superblock and nfs get root calls security sb...

PT-2026-122060

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5 authenticate In krb5 authenticate, out len is calculated to determine available headroom in response buf for the incoming Kerberos AP-REP token. However, when SMB2 SESSION SETUP is...

PT-2026-122044

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local root reference leak in scrub print warning inode When paths from inode fails, scrub print warning inode jumps to err without dropping the reference taken by btrfs get fs root, leaking a reference to the ro...

PT-2026-121839

Name of the Vulnerable Software and Affected Versions AgenticSeek versions prior to commit 409840c Description Remote code execution is possible because the llm server/app.py file hardcodes Flask debug mode while binding to all interfaces. An attacker who can access the server port and obtain the...

PT-2026-121914

In the Linux kernel, the following vulnerability has been resolved: sched ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.init cids overrides...

PT-2026-122063

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm integrity resume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructo...

PT-2026-121890

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon ptep mkold damon va prepare access check picks a random byte address within the region and stores it in r-sampling addr. damon va mkold passes it into a page table walk,...

PT-2026-121928

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiod set value emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in proces...

PT-2026-122085

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

PT-2026-122016

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick alloc card and memstick set rw addr, wait for completion timeout is used to wait for device identification and address configuration requests to complete...

PT-2026-121918

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4 irq disable masks the V3D interrupt sources and then calls synchronize irq before the V3D is powered down. However, by itself, this is not enough to quiesce the...

PT-2026-122096

Missing authorization in the native binder service 'android.dji.server' transaction code 1018 in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplie...

PT-2026-121983

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb relocate parse slow to call kvfree on entries outside the original exec array during following scenario inside eb relocate parse slow: 1 eb copy...

PT-2026-121968

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt notify add puts a mount on notify list. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

PT-2026-122039

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in read skb After a partial stream receive, rx bytes tracks the unread suffix while buf used and peer credit still cover the whole packet. virtio transport read skb dequeues that packet but...

PT-2026-121939

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign,...

PT-2026-121951

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFS IOC EXCHANGE RANGE's TO EOF flag. The bug tricks exchange-range into modifying a file so that it...

PT-2026-121931

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs dir item item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

PT-2026-121987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm recv data hands the skb to d-data ready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the...

PT-2026-121943

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization the project has no DOMPurify or equivalent dependency. JSON...

PT-2026-121828

Theres way too many incidents. Once a month became once a week. Is there a way to keep track of stuff? I found Internet Systems Consortium and they list some security advisories and its just a bunch of text entries like CVE-2026-12132 CVE-2026-2331 etc.. What do these even mean, and how read them...

PT-2026-121857

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211 hwsim: reject undersized HWSIM ATTR TX INFO hwsim tx info frame received nl casts the HWSIM ATTR TX INFO payload to a struct hwsim tx rate and unconditionally reads IEEE80211 TX MAX RATES entries 8 bytes from it. T...

PT-2026-121888

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage such as S3, GCS, or Azure to execute arbitrary file write...

PT-2026-121836

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

PT-2026-121876

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x fdma reload backs up rx-page pool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...