PT-2026-99083

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description When a Microsoft Graph request fails, the system logs the error including the authentication token used to access the mailbox. Although the system attempts to mask the token, the process is incomplete...

PT-2026-98597

In the Linux kernel, the following vulnerability has been resolved: tracing: Take trace array reference when opening a tracer options file When a tracer option file is opened, it is passed a descriptor that points to an element on the trace array's topts array. This element has information to fin...

PT-2026-98659

In the Linux kernel, the following vulnerability has been resolved: virtio console: do not free control-out buffers on remove send control msg publishes &portdev-cpkt as the control-out virtqueue cookie. remove vqs walks every virtqueue and passes leftover cookies to free buf, which treats them a...

PT-2026-98409

💻 Опережать атакующего: как находить уязвимости раньше, чем ими воспользуются 15 октября в Санкт-Петербурге пройдёт конференция CNews Петербург: Передовые технологии и кейсы России. На ней Игорь Первушин, руководитель экспертизы СайберОК, выступит с докладом «Опережать атакующего: как находить...

PT-2026-98588

In the Linux kernel, the following vulnerability has been resolved: tracing/user events: Don't destroy fields when event removal fails destroy user event destroys the event's fields before attempting to remove the trace event call. If user event set call visible fails, e.g. because the event is...

PT-2026-98743

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgroup account snapshot BUG When running btrfs/252 with quota enabled through MKFS OPTIONS="-O quota", it has a high chance to trigger the following kernel warning and flips the fs R...

PT-2026-98836

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the USB Type-C UCSI component where ucsi register creates per-instance debugfs entries, but ucsi unregister fails to remove them until ucsi destroy is called. This lea...

PT-2026-98957

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An authenticated attacker can silently remove temporary file uploads of another user before a ticket or article is submitted. This occurs because the destroy form action on the AttachmentsController...

PT-2026-98667

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...

PT-2026-98609

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADV FREE and THP Some of users of Polars a data analytics library have lost production data from this bug. They seem to have just the right combination of huge pages, MADV FREE and heavy...

PT-2026-98832

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/srpt component where the srpt alloc rw ctxs function fails to properly reset counters during an error unwind path. When a failure occurs during a multi-buffer...

PT-2026-98747

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpf loop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callback depth R1' mechanics in check...

PT-2026-98535

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the mac802154 module. The ieee802154 subif frame function queues received beacon and MAC-command frames onto local-rx beacon list and rx mac cmd list...

PT-2026-98826

Name of the Vulnerable Software and Affected Versions D-Link DAP-2610 versions prior to 2.06B08r099 Description An authenticated command injection issue exists within the web interface at the '/index.xgi' endpoint. An attacker with authenticated access can exploit specific parameters to execute...

PT-2026-98657

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfd ctx fdget error in config ctx vhost vdpa set config call swaps the eventfd ctx fdget return value into v-config ctx before checking it, so on failure the field briefly holds an ERR PTR: ctx =...

PT-2026-99124

Name of the Vulnerable Software and Affected Versions Mediawiki - Wikibase Extension versions prior to 1.46.1 Mediawiki - Wikibase Extension version 1.45.5 Mediawiki - Wikibase Extension version 1.43.10 Description Improper neutralization of input during web page generation allows for Cross-Site...

PT-2026-98928

Name of the Vulnerable Software and Affected Versions BerriAI LiteLLM versions prior to 1.101.0-rc.1 Description A tenant isolation bypass exists in the semantic cache layer due to a metadata key mismatch between the get semantic cache tenant scope and get metadata variable name functions...

PT-2026-98916

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description An incomplete fix in the MQTT topic permission handling allows a low-privileg...

PT-2026-98347

Name of the Vulnerable Software and Affected Versions MinIO versions prior to 7aac2a2 pgsty/silo versions prior to 1233254 Description MinIO fails to verify that every x-amz- header in a request is included in the client-supplied X-Amz-SignedHeaders list. The extractSignedHeaders function in...

PT-2026-98902

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x through 4.0.19 RabbitMQ versions 4.1.x through 4.1.10 RabbitMQ versions 4.2.x through 4.2.5 Description An atom table exhaustion issue exists in the management API. The PUT...

PT-2026-99087

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Zammad is a web-based open source helpdesk and customer support system. A flaw in the two-factor login process allows an attacker to perform unlimited password guesses for any account. This occurs...

PT-2026-98677

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, prevent mc list repopulation during vport disable In mlx5 esw vport disable, move esw apply vport rx mode ahead of esw vport change handle locked so vport-allmulti rule is NULL before the change handler observ...

PT-2026-98805

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethosu accelerator driver where the command stream parser incorrectly interprets bits 15:14 of NPU SET IFM,OFM PRECISION as an activation storage mode on U65...

PT-2026-98590

In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufs read cylinder copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check: ucpi-c cgx = fs32 to cpusb, ucg-...

PT-2026-98404

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.1 Description A pre-authentication attacker can exploit the way type size and count are handled to trigger excessive memory allocation, which may result in a denial of service. Recommendations Upgrad...

PT-2026-98541

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the lowpan newlink function. This occurs because TUNSETLINK allows a TUN device to change its link-layer type to ARPHRD IEEE802154 without initializi...

PT-2026-98644

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug set level Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debug set level, introducing a possible NULL pointer dereference...

PT-2026-98807

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/amdxdna component where the system fails to reject command chains that contain no commands. When the command count variable is zero, the payload length check...

PT-2026-98691

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: drop the replaced rule from the list when reprogramming fails nfp net fs add replaces an existing rule by deleting it from the hardware, decrementing nn-fs.count and programming the new one. If nfp net fs add hw fails t...

PT-2026-99072

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description An issue exists where a low-privileged authenticated user can utilize the API v2 to execute update operations that are typically restricted within the user interface. This occurs because the API...

PT-2026-98784

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan mdb remote src del vxlan mdb is valid source, which validates MDBE ATTR SOURCE and every MDBE ATTR SRC LIST member, accepts the all-zeros address. A source list is only accepted on a , G...

PT-2026-98755

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: yc: fix memory leak in acp6x pdm dma close acp6x pdm dma close does not free the runtime-private data buffer allocated in acp6x pdm dma open. Add the missing kfree...

PT-2026-98737

In the Linux kernel, the following vulnerability has been resolved: bonding: do not clear curr active slave prematurely when releasing all slaves When releasing all slaves during bond destruction all == true, bond release one unconditionally clears bond-curr active slave to NULL in every iteratio...

PT-2026-98791

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr sas port add sas port alloc num can return NULL on memory allocation failure. The return value is passed directly to sas port add without a NULL check, which causes a NULL...

PT-2026-98387

Name of the Vulnerable Software and Affected Versions WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More versions prior to 2.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

PT-2026-98508

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mptcp syncookies implementation where an uninitialised bit is used when copying information within the subflow ulp clone function. Recommendations At the moment,...

PT-2026-98377

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 3.0.5 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform...

PT-2026-98983

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

PT-2026-98696

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with mark reg known zero and then restore map ptr. This clears map uid, which is the only field distinguishin...

PT-2026-98589

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB tick broadcast oneshot control bc = tick broadcast device.evtdev; tick install...

PT-2026-98633

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix clock leak and spurious timer in settimeout msc313e wdt settimeout unconditionally calls msc313e wdt start which introduces two severe bugs: 1. If the watchdog is already active, calling start again will...

PT-2026-98955

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A SQL injection flaw exists in the Faculty Authentication component within the loginlinkfaculty.php file. A remote attacker can exploit this by...

PT-2026-98636

In the Linux kernel, the following vulnerability has been resolved: net: macb: put the "mdio" child node reference on success macb mii init holds the reference returned by of get child by name for macb mdiobus register and drops it only on the error paths, so every successful probe leaks a node...

PT-2026-98643

In the Linux kernel, the following vulnerability has been resolved: ice: add missing xa destroy for sched node ids Commit 16dfa49406bc "ice: Introduce new parameters in ice sched node" added a sched node ids xarray to the port info structure, but never called xa destroy on it. Since xarrays can...

PT-2026-98593

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actual length in interrupt callback i usx2y in04 int processes the interrupt URB data without checking urb-actual length. A short transfer from a malfunctioning device would cause the handler to proce...

PT-2026-98565

In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and...

PT-2026-98345

Name of the Vulnerable Software and Affected Versions pfSense Plus versions prior to 26.07 pfSense CE versions prior to 2.9.0 Description A Local File Inclusion LFI issue exists in the Dashboard widget sequence data handling. An authenticated attacker with permissions to modify Dashboard settings...

PT-2026-98527

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RISC-V architecture implementation of the perf subsystem where the available-counter mask is stored as a single unsigned long. Because the iteration process uses...

PT-2026-98669

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1 in urb in caiaq dev The epq in urb object belonging to the caiaq device is coupled within the struct snd usb caiaqdev. After usb submit urbepq in urb, GFP KERNEL executes successfully, epq in urb is...

PT-2026-99076

Name of the Vulnerable Software and Affected Versions GLPI versions 0.85 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description A low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected...