PT-2026-90251

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma rn unregister before rdma destroy id svc rdma free caches rdma-sc cm id-device before teardown, then calls rdma destroy idsc cm id which frees the cm id. rpcrdma rn unregister follows, but between those t...

PT-2026-90256

In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp lock before publishing proc entry create use gss proxy proc entry publishes /proc/net/rpc/use-gss-proxy via proc create data before init gssp clnt runs mutex init on sn-gssp lock. Once the dentry is linked under...

PT-2026-90268

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure param set charp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

PT-2026-90269

In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted...

PT-2026-90279

In the Linux kernel, the following vulnerability has been resolved: ip6 tunnel: use skb cow head in ip6 tnl xmit ip6 tnl xmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skb realloc headroom, copies skb-sk ownership, consum...

PT-2026-90283

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr to scan. Busy buffers therefore do not consume the scan budget. If a...

PT-2026-90285

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm security cfm looks up a session on session list and then walks its DLC list without holding rfcomm mutex. Since RFCOMM session teardown uses rfcomm mutex, krfcomm...

PT-2026-90312

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nv suspend and nv resume walk the non-PCI configuration space with for i = 0; i register size/sizeofu32; i++ which runs one iteration too many. saved config spa...

PT-2026-90371

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kick flushing caps on cf entry freed during unlock list for each entry iterates ci-i cap flush list but drops i ceph lock to send cap messages. During the unlock window, handle cap flush ack can acquire i ceph...

PT-2026-90472

In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate pages batch migrate pages batch unmaps each folio before moving it, and every unmap runs the mmu notifier invalidate callbacks. On KVM hosts try to migrate ends up in kvm m...

PT-2026-90381

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdr decode sattr: iap-ia atime.tv nsec = tmp2 NSEC PER USEC; tmp2 is a u32 and NSEC PER USEC is...

PT-2026-90315

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm probe registers the display before initializing ddata-lock. Once omapdss register display publishes the display, another consumer can reach a dsicm...

PT-2026-89762

PCRE2 before 10.48 has a pcre2 match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...

PT-2026-90036

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...

PT-2026-90051

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom slot save template endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

PT-2026-89862

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

PT-2026-90532

🇸🇪 https://t.co/leuyjDktOF Cpp daily: 24h + upcoming 🎥 3 videos 📝 3 blogs 🚀 4 releases 🎙️ 1 podcast Random 📝 pick: Security advisory: CVE-2026-19248: Unbounded ... https://t.co/uD1WmIRicq...

PT-2026-90008

Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

PT-2026-89678

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

PT-2026-90202

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd rcvr in ipmi destroy user Commit 9e91f8a6c868 "ipmi:msghandler: Remove srcu for the ipmi interfaces list" dropped the synchronize rcu between unlinking the command receivers from intf-cmd rcvrs and...

PT-2026-90126

In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...

PT-2026-90116

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has max recv sge == 1 there is no shared v2 receive buffer, and smc llc save add link rkeys takes the v2 extension from 44 bytes past the start of...

PT-2026-90327

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs attr update meta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed size field before the name and...

PT-2026-90237

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle pick task releasing the rq lock Core scheduling's pick next task breaks when a -pick task implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

PT-2026-89799

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas...

PT-2026-89889

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

PT-2026-89772

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...

PT-2026-90262

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprt complete bc request removes the request from bc pa list, drops bc...

PT-2026-89910

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

PT-2026-89786

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

PT-2026-90482

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold exec update lock around namespace ioctl The PIDFD GET NAMESPACE ioctls in pidfd ioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment state...

PT-2026-89843

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

PT-2026-89897

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus About: from 1.2.1 before 1.2.5...

PT-2026-89759

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

PT-2026-90514

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

PT-2026-90211

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm migrate request handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node ...

PT-2026-90062

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtio vsock remove stops the virtqueues and then flushes each work item before freeing the enclosing virtio vsock. The current order does not account for dependencies between those...

PT-2026-90137

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb write read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block wri...

PT-2026-90439

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs direct propagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfs direct propagate during testing. Analysis revealed that after truncating a...

PT-2026-90373

In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd client.c:osd sparse read validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is...

PT-2026-90365

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in build xattrs build xattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

PT-2026-90322

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfs parse tag 70 packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixe...

PT-2026-90277

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6 rpl srh rcv ipv6 rpl srh rcv dereferences idev from in6 dev get without a NULL check when reading idev-cnf.rpl seg enabled. When the device's MTU drops below IPV6 MIN MTU, addrconf...

PT-2026-90412

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG NFSD V4 2 INTER SSC is enabled, nfsd4 putfh can return success with fh dentry and fh export both NULL if fh verify returns nfserr stale and putfh-no...

PT-2026-90074

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd node-data buf. Several callers pass stack-allocated objects there. If wait event interruptible...

PT-2026-90198

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk rq payload bytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in write zeroes processing" established that blk rq payload bytes must not be read without first checking blk r...

PT-2026-90388

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc decode setaclargs fills in argp-acl access only when NFS ACL is set in the request mask and argp-acl...

PT-2026-90367

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs name decode in handle session handle session decodes the MDSCapAuth records carried by a CEPH SESSION OPEN message msg version = 6. For each record the match.path and match.fs name byte strings...

PT-2026-90258

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss krb5 unwrap v2 against short tokens gss krb5 unwrap v2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS KRB5 TOK HDR LEN 16 bytes long, and its rotate left...

PT-2026-90282

In the Linux kernel, the following vulnerability has been resolved: jbd2: check need resched when skipping busy checkpoint buffers journal shrink one cp list skips busy checkpoint buffers when called with JBD2 SHRINK BUSY SKIP. The continue statement on this path also skips the need resched check...