PT-2026-98688

In the Linux kernel, the following vulnerability has been resolved: net: usb: cx82310 eth: drop URB after 0xffff reboot sentinel to prevent partial data heap overflow The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest ...

PT-2026-98762

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu assign pointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6 mc list, idev-mc list, idev-mc tomb using direct pointer assignments instead of rcu assign pointer: 1...

PT-2026-98512

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the bnxt init nic function fails to propagate error return values from bnxt init rx rings. When bnxt alloc one rx ring fails, the return value...

PT-2026-98857

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description The PESI service contains a SQL injection flaw. An authenticated attacker can exploit this issue to gain unauthorized access to sensitive information stored within the internal database...

PT-2026-98934

Name of the Vulnerable Software and Affected Versions zhistaredu StarTraining versions prior to 3.8.2 Description A remote issue exists in the JWT Token Handler component within the UserLoginService.createToken function of the application.yml file. Manipulating the user id or company id arguments...

PT-2026-98750

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migrate disable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushable tasks and sti...

PT-2026-98770

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE CONN REQ + EXT FLOWCTL pchan l2cap new connection sets default value of channel mode to match the parent channel. l2cap le connect req left this at the default, and created L2CAP MODE EXT...

PT-2026-98521

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the prepare tile info buffer function where it writes one entry per tile into the tile sizes DMA buffer. This buffer is sized for a grid equal to the PPS uAPI array...

PT-2026-98514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the bnxt queue mem alloc function performs a shallow copy of the live RX ring into a clone. While some pointers are cleared, rx tpa and rx tpa...

PT-2026-99000

The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...

PT-2026-98943

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description In the global quick search, a user assigned the knowledge base.editor role in one knowledge base category can view answer titles and updated at timestamps from other categories for which they lack...

PT-2026-98670

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpf loop iteration counts bpf loop declares its nr loops argument as ARG ANYTHING. Privileged programs may pass pointer values to such arguments, so check func arg lets a pointer-valued R1 reach the...

PT-2026-98980

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cau...

PT-2026-98728

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps map check btf allows a key-less BTF btf key type id == 0 only for maps that have a -map check btf callback, and leaves the actual decision to that callback. Hash maps used to have no -map...

PT-2026-99069

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description An attacker can craft a URL for a dashboard that reflects attacker-controlled markup due to insufficient output encoding. A user who opens this crafted URL triggers reflected cross-site scripting...

PT-2026-98559

In the Linux kernel, the following vulnerability has been resolved: io uring/rw: end write accounting from -ki complete Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the io req rw complete task work. However, only the...

PT-2026-98351

Name of the Vulnerable Software and Affected Versions tinyauth versions prior to 5.1.3 Description A rule bypass is possible by appending an allowed route string. This issue stems from the use of an unanchored regular expression, which allows the system to match patterns regardless of their...

PT-2026-98781

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfs alloc subrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfs alloc subrequest. 0 When netfs alloc subrequest fails, subreq is NULL. Later, netfs...

PT-2026-98821

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7921 wifi driver where the loader trusts the region count and record length of the CLC Common Location Configuration region supplied by firmware. A malformed ima...

PT-2026-98984

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

PT-2026-98547

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpa alloc device so the allocated device and adapter pointer are released consistently...

PT-2026-98744

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if call zone finish fails do zone finish clears BLOCK GROUP FLAG ZONE IS ACTIVE before finishing the zones. If call zone finish then fails it returned early, leaving the now inactiv...

PT-2026-98816

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme-rdma module where the queue rq function handles -EIO errors in the wrong order. When a host path error is reported, the system continues to clean up the comma...

PT-2026-99123

Name of the Vulnerable Software and Affected Versions Wikimedia Foundation Wikipedia Android App affected versions not specified Description An issue exists that allows an unauthorized actor to access, intercept, or modify HTTP cookies, leading to the exposure of sensitive information...

PT-2026-99114

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Subpath symlinking on Windows nodes allows for NTLM coercion. NTLM coercion is a technique used to force a remote system to authenticate against a malicious...

PT-2026-98420

CISA added two critical flaws to the KEV catalog yesterday, confirming active exploitation in the wild. Both are being actively targeted. Technical Breakdown: - CVE-2026-5430 CVSS 9.8: Path traversal in WSO2 API Control Plane. Allows unauthenticated remote attackers to read arbitrary files or...

PT-2026-98845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A tree connection leak exists in the smb2 tree connect function. The issue occurs when the ksmbd iov pin rsp function fails, resulting in the failure to disconnect the new tree connectio...

PT-2026-98716

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix init config access Existing code accesses enties found in -init configs array through indexes that are part of -config ids array. Those two are limited by: -num init configs and -num config ids...

PT-2026-98891

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description An authenticated administrator can store a crafted expression via the image order variable in the 'admin/element set ranks.php' endpoint because the application fails to enforce the sort-field...

PT-2026-98482

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system where the xagb bitmap set call within the xrep agfl fill function can fail. Because the result of xagb bitmap walk is not checked, the system...

PT-2026-98713

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum ptp: Fix napi gro receive call from GC workqueue context Currently mlxsw sp1 ptp ht gc collect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries...

PT-2026-98843

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rtl8723bs staging driver where padapter-HalData is allocated using vzalloc but incorrectly released using kfree within the rtw sdio if1 init error path. Using kfre...

PT-2026-98503

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The SMB1 synchronous read helper function CIFSSMBRead fails to validate the DataOffset value provided by the server. While the function checks DataLength against CIFSMaxBufSize and the...

PT-2026-98534

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current check refer path reads old dentry-d parent without holding a reference nor a lock on it, and then dereferences it in collect domain accesses and in the audit...

PT-2026-98722

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark sched process wait argument as nullable do wait passes wo-wo pid to the sched process wait tracepoint. kernel wait4 leaves wo pid NULL for wait4-1, and kernel waitid prepare does likewise for waitidP ALL. btf ctx access...

PT-2026-98697

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise check map kptr access permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, i...

PT-2026-98540

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ieee802154 driver for the cc2520 device. The FIFOP interrupt handler queues cc2520 fifop irqwork, but during the removal process, the cc2520 remove...

PT-2026-98701

In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcount acquire nullable for borrowed RCU kptrs bpf refcount acquire is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KF RET NULL on the return valu...

PT-2026-98673

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drr change class rejects explicit quantum==0 but falls back to psched mtu with no floor. With a crafted size table qdisc pkt len reaches 2 GiB, so quantum=1 or a zero psched mtu on a...

PT-2026-98749

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacy rmidi before it exists snd ump parse endpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump handle ep name msg then treats parsed as "lega...

PT-2026-98803

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the update reparse data function ignores the return value of set reparse index. If the index insertion fails, the system removes the recently...

PT-2026-98811

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem regarding per-CPU map updates for array, hash, and cgroup storage maps when BPF F CPU or BPF F ALL CPUS are not used. The syst...

PT-2026-99091

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

PT-2026-98563

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leak in query perf config list When krealloc fails, free the original oa config ids before returning to avoid a memory leak. cherry picked from commit 9977e9d84f46d4f12ad35fbbc0ec4638554bce87...

PT-2026-99129

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to revoke administrative privileges immediately after a role downgrade. This occurs because the Admin Controller relies on the user type snapshot stored in an active session...

PT-2026-98491

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS filesystem where the xfs parent da args init function initializes xfs da args from a zeroed xfs parent args, leaving the args-total variable set to 0. The xfs ...

PT-2026-98939

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An unauthenticated remote attacker can cause a denial of service on a production instance. This occurs because the import check and import status actions lack the setup done response guard, allowing...

PT-2026-98686

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

PT-2026-98631

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-cpro Remove debugfs entries when probe fails ccp debugfs init registers debugfs files whose private data is the devm allocated ccp. If hwmon device register with info fails right after it, ccp probe returns without...

PT-2026-98465

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the x86 memory management where Page Table Entries PTE are allocated directly during the splitting of a large page via the split large page function, bypassing standar...