PT-2026-98406

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.1 Description Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion, and HTTP management JSON rendering...

PT-2026-98989

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...

PT-2026-98545

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the erofs component regarding the preservation of LZMA decoders during a pool-resize failure. The pool-resize path frees an old decoder before allocating a replacement...

PT-2026-98641

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusb data by rx work btusb close and btusb flush cancel data-rx work with the asynchronous cancel delayed work, so if btusb rx work is already running on another CPU it keeps running after the cancel...

PT-2026-98392

Name of the Vulnerable Software and Affected Versions Modula Image Gallery – Photo Grid & Video Gallery versions prior to 3.0.3 Description Insufficient file path validation in the upload image function allows authenticated attackers with author-level access or higher to delete arbitrary files on...

PT-2026-98587

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the var ref when its initialization fails create var ref allocates a VAR REF hist field and then calls init var ref to fill it in. When that fails the field is leaked. commit 656fe2ba85e8 "tracing: Use his...

PT-2026-98777

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

PT-2026-98780

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfront There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at th...

PT-2026-98487

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system when exchanging two full-file ranges. The function xmi can exchange reflink flags may incorrectly move the reflink inode flag between files when XF...

PT-2026-98973

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

PT-2026-98783

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313e wdt probe doesn't set the driver data for the platform device. As a result, dev get drvdata in msc313e wdt suspend and msc313e wdt resume will return NULL,...

PT-2026-98801

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the ntfs cluster free from rl nolock function incorrectly increments the nr freed counter even when ntfs bitmap clear run fails. This occurs...

PT-2026-98868

Name of the Vulnerable Software and Affected Versions FTM versions 4.x Description An XML external entity XXE injection flaw allows a remote authenticated attacker to obtain sensitive information. XXE is a type of attack that occurs when an application processes XML input containing a reference t...

PT-2026-99119

Name of the Vulnerable Software and Affected Versions RustDesk versions prior to 1.5.0 Description On Windows, the software fails to enforce the one-way file transfer option when handling peer clipboard file requests. This allows authenticated peers to read files from the host clipboard by sendin...

PT-2026-98570

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in get boot config from initrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size;...

PT-2026-98398

Name of the Vulnerable Software and Affected Versions Themify Builder versions prior to 7.8.2 Description The plugin is subject to Stored Cross-Site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and...

PT-2026-98519

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mediatek vcodec component where the vdec av1 slice setup tile function copies tile cols + 1 and tile rows + 1 entries from the bitstream tile info into the mi col...

PT-2026-98756

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl micfil: balance mclk enable/disable hw params enables mclk unconditionally and hw free disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hw free can run without hw params, and hw params can b...

PT-2026-98352

Name of the Vulnerable Software and Affected Versions Wakapi versions prior to 2.17.6 Description The user caching service allows a lookup to be resolved in an unintended lookup context. This flaw occurs when user caching is enabled and can lead to account takeover. Recommendations Update to...

PT-2026-98717

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count strace open invokes try module get which on success takes the module reference. If any follow up operation causes strace open to fail, the refcount shall be put down...

PT-2026-98355

Name of the Vulnerable Software and Affected Versions Sanluan PublicCMS versions prior to 6.202506.e Description An authorization bypass exists in the exportExcel/exportData component. The issue resides within the CmsContentAdminController function located in the...

PT-2026-98666

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 "iommu/amd: Simplify and Consolidate Virtual APIC AVIC Enablement" moved the GA log allocation from iommu init pci to enable iommus vapic, which is called ...

PT-2026-98956

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to the improper handling of the gid argument within an unknown function in the updatequery.php...

PT-2026-98752

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in alb determine nd alb determine nd uses icmp6 hdrskb to inspect ICMPv6 headers. However, in xmit paths e.g. packets sent via AF PACKET / raw sockets or forwarded packets,...

PT-2026-98933

A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The...

PT-2026-98574

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprd platform compr open allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprd platform compr copy...

PT-2026-98987

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

PT-2026-99005

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...

PT-2026-98486

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system where the xrep dir recover data function can enter an infinite loop when salvaging directory entries. This occurs if the system encounters an unuse...

PT-2026-98654

In the Linux kernel, the following vulnerability has been resolved: vdpa sim net: check TX pull result before RX copy vringh iov pull iotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size t length to receive filter and vringh...

PT-2026-98820

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ppp async component where the process input packet function incorrectly resets a reused socket buffer skb headroom to zero during a frame-error path. This violates...

PT-2026-98679

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in sample restore put Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restore lock. At that point another thread may already have...

PT-2026-98689

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: properly convert mglist to rcu Sashiko reported a bug 1 that br multicast del port group unlists the port group not using proper rcu helper that preserves the next pointer and after that immediately frees the...

PT-2026-98872

Name of the Vulnerable Software and Affected Versions sheshbabu zen versions prior to 1.5.1 Description A remote cross-site scripting issue exists in the Note Editor component within the dangerouslySetInnerHTML function of the features/notes/NotesEditor.jsx file. Cross-site scripting is a techniq...

PT-2026-98411

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS exists in the API and management panel. The issue occurs on the server side at the REST endpoint '/inventory/configuration/pricing-tiers', where malicious...

PT-2026-98882

Name of the Vulnerable Software and Affected Versions Piwigo versions 17.0.0beta1 and earlier Description An unauthenticated guest can perform error-based or blind extraction of database information and trigger database-dependent time delays through the public search flow when rating is enabled...

PT-2026-98974

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

PT-2026-99066

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description A form administrator can utilize the Form import feature with a specially crafted illustration or scene identifier to perform a directory traversal attack, allowing files to be written outside th...

PT-2026-99099

Name of the Vulnerable Software and Affected Versions GNU libextractor versions prior to 1.16 Description The software loads plugins from an untrusted search path defined by the LIBEXTRACTOR PREFIX environment variable without performing proper privilege checks. A local attacker can manipulate th...

PT-2026-98553

In the Linux kernel, the following vulnerability has been resolved: net: mana: Reserve extra CQ slot for the fence completion CQE The RX completion queue is sized to hold exactly one CQE per posted RX WQE. MANA FENCE RQ makes hardware post an additional CQE RX OBJECT FENCE after the packet CQEs...

PT-2026-99134

Name of the Vulnerable Software and Affected Versions Actual Sync Server versions prior to 26.7.0 Description The CORS proxy in Actual Sync Server allows authenticated users to fetch resources from repositories on an official plugin allowlist. When the ACTUAL GITHUB TOKEN is configured, the proxy...

PT-2026-98615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iSCSI target of the SCSI subsystem where a LUN RESET a command used to reset a Logical Unit that aborts a WRITE command in the TRANSPORT WRITE PENDING state can...

PT-2026-98893

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.7 RabbitMQ versions 4.3.0 through 4.3.1 Description A successful request to the 'POST /login' endpoint causes the is authorized/2 function to set an authentication cookie containing base64-encoded username a...

PT-2026-98472

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qla2xxx SCSI driver where the qla2x00 mem alloc function fails to nullify pointers after freeing them during an error path. When qla2x00 probe one encounters a...

PT-2026-99062

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description The software fails to enforce form fill-in restrictions on the authenticated submission endpoint "POST /user/form/data/create". Authenticated attackers with knowledge of a form's key can subm...

PT-2026-98610

In the Linux kernel, the following vulnerability has been resolved: x86/amd node: Fix PCI device reference counting in amd smn init The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the...

PT-2026-98734

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cp flags bits individually in rds conn path reset rds conn path reset wipes the whole flag word with a plain cp-cp flags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run...

PT-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6 route iter active treats a walker in FWS U at the table root as already unlinked. fib6 del route can move a still-linked walker into that same state when the current leaf is the last rou...

PT-2026-98515

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Stateless AV1 decoders fail to properly bound the tile cols and tile rows fields within std validate compound. These fields are used as loop bounds, as indices for the mi starts and in s...

PT-2026-99089

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description The External Data Source feature, which retrieves records from external systems, fails to properly verify user permissions before including record details in requests. An authenticated user with basic...