PT-2026-98767

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oa tc6: Improve the error recovery When oversubscribed traffic causes lot of buffer overflow errors, probably due to loss of data chunks, driver fails to find a data chunk with end valid bit set, before it runs out...

PT-2026-99081

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description The HTML sanitizer used in ticket articles and email views fails to correctly identify and block remote images when a shortened URL format is used that omits the double slash after the scheme. Because...

PT-2026-98517

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Verisilicon Rockchip media component where the rockchip vpu981 av1 dec set tile info function indexes the tile group entry array using tile1 tile cols + tile0...

PT-2026-98373

Name of the Vulnerable Software and Affected Versions Bookly versions prior to 28.3 Description The Bookly plugin for WordPress contains an Insecure Direct Object Reference IDOR flaw. This occurs because the bookly get form id handler stores an attacker-controlled order id from the form data into...

PT-2026-98652

In the Linux kernel, the following vulnerability has been resolved: vhost: invalidate vring access on IOTLB transitions When VIRTIO F ACCESS PLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space. Keeping them across the transition can leave stale...

PT-2026-99001

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http v3 module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner...

PT-2026-98834

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/msm component where retiring a hung submit during recovery occurs before the GPU is recovered. This sequence triggers the freeing of Buffer Objects BOs, which...

PT-2026-99122

Name of the Vulnerable Software and Affected Versions Mediawiki - Translate Extension versions prior to 1.46.1 Mediawiki - Translate Extension version 1.45.5 Mediawiki - Translate Extension version 1.43.10 Description An authorization flaw exists where functionality is not properly constrained by...

PT-2026-99095

Name of the Vulnerable Software and Affected Versions krayin laravel-crm versions prior to 2.2.6 Description A remote cross-site scripting issue exists within the Upload Functionality component. The flaw is located in the ConfigurationForm::rules function of the...

PT-2026-99117

Name of the Vulnerable Software and Affected Versions CliInvoke versions 2.0.0 through 2.8.4 CliInvoke versions 2.9.0 through 2.9.3 CliInvoke versions 2.10.0 through 2.10.4 CliInvoke versions 3.0.0-alpha.1 through 3.0.0-beta.1 AlastairLundy.CliInvoke versions 2.0.0-alpha.1 through 2.0.0 Descripti...

PT-2026-98859

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An authenticated attacker can exploit a command injection flaw in the GIM bundle import functionality. By providing a specially crafted GIM bundle, an attacker can pass controlled arguments...

PT-2026-98858

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Improper limitation of a pathname to a restricted directory allows a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code. Recommendations At t...

PT-2026-99126

Name of the Vulnerable Software and Affected Versions Mediawiki - ExternalData Extension versions prior to 3.7 Description An OS Command Injection issue exists in the ExternalData extension, which allows unauthenticated remote code execution through wikitext. This occurs due to the improper...

PT-2026-98583

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger event hist trigger named init puts the trigger on the global named triggers list and only then takes the reference on the trigger it shares its histogram...

PT-2026-99120

Name of the Vulnerable Software and Affected Versions SCBE-AETHERMOORE versions 4.0.2 through 4.2.0 Description The AetherBrowser API server scripts/aetherbrowser/api server.py exposes the POST /api/ops/check-email endpoint without authentication. A remote attacker can call this endpoint to trigg...

PT-2026-98910

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.7 RabbitMQ versions 4.3.0 through 4.3.1 Description The get auth mechanism/1 function uses term to binary/1 on the strict auth mechanism or preferred auth mechanism atom when clearing cookies. This process...

PT-2026-98647

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSE IOTLB GET FD and VDUSE VQ GET INFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GET F...

PT-2026-98418

Name of the Vulnerable Software and Affected Versions Bookly WordPress plugin versions prior to 28.3 Description An issue exists where the software fails to properly verify a customer's identity before updating stored details. This allows unauthenticated attackers who possess a customer's primary...

PT-2026-99100

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-197 Description A path traversal issue exists in the admin template editor. Authenticated administrators with manage template access permission can use directory traversal sequences in the folder parameter to...

PT-2026-98919

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description An information exposure occurs when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured Identity Provider IDP uses a client...

PT-2026-98617

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmac tso xmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - proto hdr len / TSO MAX BUFF SIZE + 1 which assumes the payload is...

PT-2026-98724

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls prepare func exit for the taken branch. When the current frame...

PT-2026-98871

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo extension versions prior to 3.9.5 Description Improper neutralization of input during web page generation in the Mediawiki - Cargo extension allows Stored Cross-Site Scripting XSS, a condition where malicious scripts are...

PT-2026-98774

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its listening socket is shutdown. The netdevice notifier shuts down the socket before calling kthread stop, so the task struct can be freed before...

PT-2026-98498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the SMB client during a deferred close operation. When cifs close defers a close, it assigns the cifsFileInfo reference of the closing struct file to queued...

PT-2026-98598

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parse fiel...

PT-2026-99096

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.6 Description A remote cross-site scripting issue exists due to improper processing within the Sanitizer.php file of the TinyMCE Media Upload component. Cross-site scripting is a technique where malicio...

PT-2026-98997

Creating a "2dsphere bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable encrypted range" indices. This issue affects MongoDB...

PT-2026-98888

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2-beta-1 Description InvoicePlane fails to enforce email syntax for client email values and renders them unescaped within double-quoted value attributes in the invoice mailer and quote mailer forms. This allows an...

PT-2026-98776

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse dacl silently accepts truncated ACEs and allocation failures, allowing set info sec to continue with an incomplete ACL conversion. Return parsing and allocation errors to parse sec desc ...

PT-2026-98740

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: fix OOB read in sip skip whitespace sip skip whitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sip follow continuation returns on...

PT-2026-99084

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Unsanitized option labels are rendered as raw HTML without escaping in the configuration dialogs of AI Agents within the admin UI. An attacker can inject arbitrary HTML and JavaScript by controlling a...

PT-2026-98586

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referenced Using the same variable three or more times in one hist trigger leaks the variable reference and its strings when the trigger is removed. commit...

PT-2026-99090

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Zammad fails to properly verify the trust of signing certificates when processing incoming S/MIME-signed emails. Instead of validating the certificate chain, the system only checks if a certificate wi...

PT-2026-98602

In the Linux kernel, the following vulnerability has been resolved: reboot: fix cad pid use-after-free race cad pid is a single kernel-wide struct pid pointer. proc do cad pid reads it and passes it to pid vnr without protecting the lifetime of the referenced struct pid. A concurrent writer can...

PT-2026-98787

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3 insert range and smb3 collapse range use truncate pagecache range to invalidate the affected page cache. However, if off or old eof is not page-aligned, the boundary...

PT-2026-99018

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to...

PT-2026-98358

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6 Description Insufficient escaping of parameters used in the addresses of links generated on front-end directory pages allows Reflected Cross-Site Scripting XSS. This occurs via the link tags and link price...

PT-2026-98945

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.1 Description An authenticated user with low privileges can inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title during the standard ticket creation process. This occurs because th...

PT-2026-98680

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM NEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded mini Qdisc to lockless readers. If the same request has an...

PT-2026-98359

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6 Description Insufficient sanitization of a user-supplied destination folder occurs when writing a generated image to disk. This allows users with the Contributor role and above to create directories and wri...

PT-2026-98319

Name of the Vulnerable Software and Affected Versions Lemonldap::NG::Portal versions 2.20.0 through 2.21.5 Lemonldap::NG::Portal versions 2.22.0 through 2.23.3 Description An issue exists in the OAuth2 token introspection process where the checkEndPointAuthenticationCredentials function fails to...

PT-2026-98876

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2-rc-1 Description InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file plac...

PT-2026-98407

Name of the Vulnerable Software and Affected Versions misp-modules affected versions not specified Description The cisco firesight manager ACL rule export module generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration...

PT-2026-98715

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmasp xmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still he...

PT-2026-98938

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An authorization bypass exists where a customer with access to a ticket can download attachments from internal ticket articles. While the article listing API correctly hides internal articles, the...

PT-2026-98390

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.1 Description Improper handling of property-encoding exceptions during AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers. This...

PT-2026-98642

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TP printk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event ice tx dim work has double dereference in TP printk: REC-q vector-tx.tx ring-q...

PT-2026-98406

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.1 Description Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion, and HTTP management JSON rendering...

PT-2026-98989

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...