PT-2026-98787

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3 insert range and smb3 collapse range use truncate pagecache range to invalidate the affected page cache. However, if off or old eof is not page-aligned, the boundary...

PT-2026-98752

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in alb determine nd alb determine nd uses icmp6 hdrskb to inspect ICMPv6 headers. However, in xmit paths e.g. packets sent via AF PACKET / raw sockets or forwarded packets,...

PT-2026-98724

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls prepare func exit for the taken branch. When the current frame...

PT-2026-98740

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: fix OOB read in sip skip whitespace sip skip whitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sip follow continuation returns on...

PT-2026-98758

In the Linux kernel, the following vulnerability has been resolved: af packet: Don't cast tpacket hdr.tp len to int in tpacket parse header. syzbot reported BUG in sock sendmsg nosec. 0 The problem is that tpacket parse header casts user-provided tpacket hdr.tp len, which is u32, to int. If the...

PT-2026-98717

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count strace open invokes try module get which on success takes the module reference. If any follow up operation causes strace open to fail, the refcount shall be put down...

PT-2026-98642

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TP printk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event ice tx dim work has double dereference in TP printk: REC-q vector-tx.tx ring-q...

PT-2026-98617

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmac tso xmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - proto hdr len / TSO MAX BUFF SIZE + 1 which assumes the payload is...

PT-2026-98402

Name of the Vulnerable Software and Affected Versions Zero Spam for WordPress versions prior to 5.7.11 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs through the Contact Form 7 integration whe...

PT-2026-98703

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check check cond jmp op accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTR MAYBE NULL from rA in the...

PT-2026-98488

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system where the rtrmap maxlevels ondisk and rtrefcount maxlevels ondisk functions fail to account for the inode root when computing the size of in-memory...

PT-2026-98623

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls route: free emptied bucket on filter move route4 change can move an existing filter to a different top-level bucket: route4 set parms recomputes the handle from TCA ROUTE4 TO/ FROM/IIF, and the handle-mismatch chec...

PT-2026-98888

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2-beta-1 Description InvoicePlane fails to enforce email syntax for client email values and renders them unescaped within double-quoted value attributes in the invoice mailer and quote mailer forms. This allows an...

PT-2026-98890

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description In the 'admin/themes standard pages.php' endpoint, the application validates uploaded logo content by MIME type but uses the attacker-controlled std pgs logo extension when creating the stored...

PT-2026-98776

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse dacl silently accepts truncated ACEs and allocation failures, allowing set info sec to continue with an incomplete ACL conversion. Return parsing and allocation errors to parse sec desc ...

PT-2026-98720

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nr subbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nr subbufs without making sure that it matched the nr pages + 1 on data that was assuming the two were the...

PT-2026-98738

In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPF PSEUDO FUNC reference to the main program fixups.c:jit subprogs rewrites BPF PSEUDO FUNC loads to contain real function addresses. This function is invoked from bpf jit subprogs only when env-subprog cnt 1. Meanin...

PT-2026-99062

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description The software fails to enforce form fill-in restrictions on the authenticated submission endpoint "POST /user/form/data/create". Authenticated attackers with knowledge of a form's key can subm...

PT-2026-98680

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM NEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded mini Qdisc to lockless readers. If the same request has an...

PT-2026-98524

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the afs lookup server function where the system incorrectly attempts to free an existing server's endpoint state during the cleanup of a candidate server. Because the...

PT-2026-98774

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its listening socket is shutdown. The netdevice notifier shuts down the socket before calling kthread stop, so the task struct can be freed before...

PT-2026-98395

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.1.7 Description Stored Cross-Site Scripting occurs via the 'telegram' profile field due to insufficient input sanitization and output escaping in the profile update action. The raw $ POST'data' array is copied...

PT-2026-98473

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the x86 memory management page attribute table PAT implementation. The problem occurs during attribute changes when a lockless page table walker retrieve...

PT-2026-98603

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRT TABLE and MRT6 TABLE. Each unseen id allocates an mr table via the shared mr table...

PT-2026-98598

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parse fiel...

PT-2026-98586

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referenced Using the same variable three or more times in one hist trigger leaks the variable reference and its strings when the trigger is removed. commit...

PT-2026-98596

In the Linux kernel, the following vulnerability has been resolved: tracing: Don't dereference trace event file in deferred trigger free The enable event trigger defers trace event put ref to the trigger free kthread, but the trace event file can already be freed when the instance is removed. Kee...

PT-2026-98498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the SMB client during a deferred close operation. When cifs close defers a close, it assigns the cifsFileInfo reference of the closing struct file to queued...

PT-2026-98476

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the scsi qla2xxx driver during queue teardown. The response queue MSI-X handler qla2xxx msix rsp q schedules the qla do work function via queue workha-wq...

PT-2026-98602

In the Linux kernel, the following vulnerability has been resolved: reboot: fix cad pid use-after-free race cad pid is a single kernel-wide struct pid pointer. proc do cad pid reads it and passes it to pid vnr without protecting the lifetime of the referenced struct pid. A concurrent writer can...

PT-2026-98489

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.3 Description An issue exists in the XFS file system where blocks are under-reserved when repairing shortform directories. This occurs because the xfs da args object passed to xfs dir2 sf to block incorrectly...

PT-2026-98610

In the Linux kernel, the following vulnerability has been resolved: x86/amd node: Fix PCI device reference counting in amd smn init The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the...

PT-2026-98875

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to perform strict integer validation on the tax rate decimal places setting, which is controlled by the administrator. This value is interpolated into an ALTER TABLE statement...

PT-2026-98871

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo extension versions prior to 3.9.5 Description Improper neutralization of input during web page generation in the Mediawiki - Cargo extension allows Stored Cross-Site Scripting XSS, a condition where malicious scripts are...

PT-2026-98945

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.1 Description An authenticated user with low privileges can inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title during the standard ticket creation process. This occurs because th...

PT-2026-98882

Name of the Vulnerable Software and Affected Versions Piwigo versions 17.0.0beta1 and earlier Description An unauthenticated guest can perform error-based or blind extraction of database information and trigger database-dependent time delays through the public search flow when rating is enabled...

PT-2026-98876

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2-rc-1 Description InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file plac...

PT-2026-98319

Name of the Vulnerable Software and Affected Versions Lemonldap::NG::Portal versions 2.20.0 through 2.21.5 Lemonldap::NG::Portal versions 2.22.0 through 2.23.3 Description An issue exists in the OAuth2 token introspection process where the checkEndPointAuthenticationCredentials function fails to...

PT-2026-99096

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.6 Description A remote cross-site scripting issue exists due to improper processing within the Sanitizer.php file of the TinyMCE Media Upload component. Cross-site scripting is a technique where malicio...

PT-2026-98359

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6 Description Insufficient sanitization of a user-supplied destination folder occurs when writing a generated image to disk. This allows users with the Contributor role and above to create directories and wri...

PT-2026-98360

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn fr...

PT-2026-98705

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collect linked regs check cond jmp op copies the compared registers into env-false,true reg1,2 before collect linked regs runs and copies those snapshots back into both branch states...

PT-2026-98685

In the Linux kernel, the following vulnerability has been resolved: net: cap tx queue len at S16 MAX to prevent oversized ring allocations Several subsystems allocate ring buffers sized by dev-tx queue len with no upper bound. An unprivileged user via unshare -Urn can set a huge tx queue len and...

PT-2026-98358

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6 Description Insufficient escaping of parameters used in the addresses of links generated on front-end directory pages allows Reflected Cross-Site Scripting XSS. This occurs via the link tags and link price...

PT-2026-98407

Name of the Vulnerable Software and Affected Versions misp-modules affected versions not specified Description The cisco firesight manager ACL rule export module generates a shell script .sh that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration...

PT-2026-98820

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ppp async component where the process input packet function incorrectly resets a reused socket buffer skb headroom to zero during a frame-error path. This violates...

PT-2026-98973

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

PT-2026-98990

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

PT-2026-98601

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copy exec state dup task struct copies the parent's task struct, including ret stack. ftrace graph init task clears the copied function graph state, but it currently runs after...

PT-2026-99084

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description Unsanitized option labels are rendered as raw HTML without escaping in the configuration dialogs of AI Agents within the admin UI. An attacker can inject arbitrary HTML and JavaScript by controlling a...