PT-2026-98686

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

PT-2026-98631

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-cpro Remove debugfs entries when probe fails ccp debugfs init registers debugfs files whose private data is the devm allocated ccp. If hwmon device register with info fails right after it, ccp probe returns without...

PT-2026-98465

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the x86 memory management where Page Table Entries PTE are allocated directly during the splitting of a large page via the split large page function, bypassing standar...

PT-2026-98321

Name of the Vulnerable Software and Affected Versions ningzichun student-management-system versions prior to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Description An authorization bypass exists in the file admin/fun/getStudent.php. A remote attacker can exploit this by manipulating the sid argumen...

PT-2026-98605

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-list lock in slab try return freelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slab try return freelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freeli...

PT-2026-98994

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

PT-2026-98960

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists within the Student Update Functionality component in the updatestudent.php file. The issue occurs when the eno argumen...

PT-2026-98414

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/serial-number-types' endpoint, where...

PT-2026-98795

In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfs set ea, the exit path unconditionally updates the HasEA flag based on ea info qsize. When an error occurs before ea info qsize is updated, NInoClearHasEA hides existing...

PT-2026-98551

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl mask array realloc retires the old mask array before it stops being reachable: old = ovsl dereferencetbl-mask array; if old ... call rcu&old-rcu, mask array rc...

PT-2026-98746

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfs insert one raid extent aborts and ends the transaction before returning -ENOMEM. btrfs finish one ordered, the...

PT-2026-98484

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the xfs module when the xqcheck mod live ino dqtrx function fails to free a newly allocated dqa object following a failed rhashtable insertion. Recommendations At...

PT-2026-98614

In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing -ci dentry create link reads the target's configfs dirent from item-ci dentry-d fsdata, relying on the item reference taken by get target. That reference pins the item,...

PT-2026-98650

In the Linux kernel, the following vulnerability has been resolved: virtio input: stop callbacks before unregistering input device virtinput remove unregisters the input device before resetting the virtio device. virtinput recv events drops vi-lock around input event, so clearing vi-ready does no...

PT-2026-98350

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.08 Description The ticket email parser, located at the endpoint 'cron/ticket email parser.php', allows SVG attachments in email messages received via SMTP from arbitrary senders. Recommendations Update to version...

PT-2026-98368

Name of the Vulnerable Software and Affected Versions JetFormBuilder versions prior to 3.6.5.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS, a technique where malicious scripts are injected into a web...

PT-2026-98528

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 crypto subsystem where the hardware may persistently return an -EBUSY error after exhausting retries. This error propagates to the crypto finalize request...

PT-2026-98375

Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.182 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level...

PT-2026-98525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-unmap issue exists in the AFS Andrew File System component. The afs edit dir remove function manually unmaps blocks without clearing afs dir iter::block. This can lead to a...

PT-2026-98342

Name of the Vulnerable Software and Affected Versions ningzichun student-management-system versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Description A remote cross site scripting issue exists in the echo function within the admin/fun/addLog.php file. This occurs when the reason/detail...

PT-2026-98520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rkvdec media component where the compute tiles uniform and compute tiles non uniform functions loop over entries based on num tile columns minus1 + 1 and num tile...

PT-2026-98846

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description The tag selector component located at var/www/static/js/tags.js is susceptible to stored cross-site scripting XSS. An authenticated user with permissions to create custom tags can embed...

PT-2026-98611

In the Linux kernel, the following vulnerability has been resolved: x86/amd node: Fix potential NULL pointer dereference amd smn read/write are exported functions around amd smn rw, so they are always available even if amd smn init fails. In that case, 'amd roots' is NULL and amd smn rw will acce...

PT-2026-98675

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfq change accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fq codel change and the init clamp. Conditions to recreate the bug: CONFIG NET SCH...

PT-2026-98649

In the Linux kernel, the following vulnerability has been resolved: af unix: Update last skb marker in manage oob. Fahad Alharbi reported that blocking recvMSG PEEK could hog CPU due to OOB skb. In the following cases, manage oob skips OOB skbs and returns NULL for the last recvMSG PEEK:...

PT-2026-98612

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" refactored the EEH code such that the pci rescan remove lock is held at the...

PT-2026-98708

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpf get stack and bpf get task stack pass may fault=true into the common stack collection code. Resolving user-space build IDs may then call build id parse...

PT-2026-98621

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow check mbox seq id and seg len validates that seq id does not exceed SEQ ID MAX VAL 42 and seg len does not exceed MBOX SEG LEN 48. However, this allows the last segment seq id=42 to...

PT-2026-98399

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site...

PT-2026-98349

Name of the Vulnerable Software and Affected Versions IRONMACE Ironshield version 1.0.0.167 Description The tvk.sys kernel-mode driver authenticates client executables by verifying expected publisher and root-certificate strings within the WIN CERTIFICATE data, specifically checking for "IRONMACE...

PT-2026-98709

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf btf find by name kind as sleepable When bpf btf find by name kind finds a type in module BTF, it returns a new BTF object fd through btf new fd. This reaches anon inode getfd, which can sleep while allocating or...

PT-2026-98637

In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macb mii init creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macb alloc tieoff or...

PT-2026-98572

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci dev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hci dev...

PT-2026-98700

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTR UNTRUSTED but retains MEM ALLOC. The pointer may be NULL or may refer to an object whose lifetime ...

PT-2026-98376

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 3.0.5 Description An issue exists where authenticated users with subscriber-level access and above can perform a generic SQL Injection. This occurs due...

PT-2026-98344

Name of the Vulnerable Software and Affected Versions Software Mansion React Native Worklets versions prior to 0.12.2 Description Prototype pollution occurs when an attacker-controlled object containing a proto property modifies the prototype of an object created during serialization within the...

PT-2026-98847

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description The username timeline feature is susceptible to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an...

PT-2026-98850

Name of the Vulnerable Software and Affected Versions kitty versions 0.40.0 through 0.48.x Description An out-of-bounds write exists in the natural width branch of the text sizing protocol. The screen handle multicell command function in kitty/screen.c appends each codepoint of a grapheme cluster...

PT-2026-98808

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/amdxdna component where the amdxdna cmd chain structure uses a flexible array annotated with counted bycommand count. Because this structure is stored in...

PT-2026-98509

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the queue can stop and fail to restart. This occurs when the driver receives a burst of packets and marks Buffer Descriptors BD with the NO CM...

PT-2026-99078

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An issue exists where attacker-controlled HTML in inbound emails or tickets can bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browse...

PT-2026-98646

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmac rx function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and...

PT-2026-98915

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description The Shovel component fails to format state logged by the crash reporter, whic...

PT-2026-99077

Name of the Vulnerable Software and Affected Versions Zammad versions 7.0.3 and 7.1.1 Description Zammad is a web-based open source helpdesk and customer support system. The software incorrectly verifies inbound PGP-signed emails under certain conditions, marking messages as having a valid PGP...

PT-2026-98536

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description IPVS sync receivers fail to properly validate protocol states for connection templates, logging states outside the template state range but still storing the invalid values in the...

PT-2026-98585

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing a hist trigger whose value or variable carries a modifier that is not allowed there leaks the fields that were built for it. create val field takes the field...

PT-2026-98635

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimize ns takes a reference on the candidate namespace before may list ns has decided whether the caller may see it. The freens put cleanup on the denied pa...

PT-2026-98462

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Multipath TCP MPTCP implementation where incorrect accounting occurs within the mptcp subflow push pending function. If the subflow push pending function returns a...

PT-2026-98624

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Prevent drain pebs reentry The PEBS buffer is shared by all events on a CPU, so drain pebs must not be reentered. If so, one instance may observe stale buffer state and potentially access out-of-bound memory. Most...

PT-2026-98471

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx report id acquisition format-1 handling walks ha-vp list under vport slock, takes a vref count on the matching vport and calls qla update host map to...