PT-2026-90198

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk rq payload bytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in write zeroes processing" established that blk rq payload bytes must not be read without first checking blk r...

PT-2026-90388

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc decode setaclargs fills in argp-acl access only when NFS ACL is set in the request mask and argp-acl...

PT-2026-90367

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs name decode in handle session handle session decodes the MDSCapAuth records carried by a CEPH SESSION OPEN message msg version = 6. For each record the match.path and match.fs name byte strings...

PT-2026-90258

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss krb5 unwrap v2 against short tokens gss krb5 unwrap v2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS KRB5 TOK HDR LEN 16 bytes long, and its rotate left...

PT-2026-90282

In the Linux kernel, the following vulnerability has been resolved: jbd2: check need resched when skipping busy checkpoint buffers journal shrink one cp list skips busy checkpoint buffers when called with JBD2 SHRINK BUSY SKIP. The continue statement on this path also skips the need resched check...

PT-2026-90193

In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp process strreset outreq, sctp process strreset addstrm out and sctp process strreset resp complete a pending stream reconfiguration request by stopping the reconf timer...

PT-2026-89860

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $ REQUEST'id' to Category::deleteAssets, which...

PT-2026-90488

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the folio clear dirty for io call in extent write cache pages with a plain folio test dirty check. Besides...

PT-2026-89908

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

PT-2026-90526

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...

PT-2026-90038

Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...

PT-2026-90099

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

PT-2026-90443

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICV DIR INTID vgic v2 deactivate passes the INTID a guest wrote to GICV DIR straight to vgic get vcpu irq, and treats a failed lookup as a "can't happen" condition with WARN ON ONCE...

PT-2026-89743

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM Build 109...

PT-2026-90037

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

PT-2026-90506

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

PT-2026-90134

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed...

PT-2026-89808

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

PT-2026-90180

In the Linux kernel, the following vulnerability has been resolved: power: supply: twl4030 charger: cancel workers via devm bci is devm-allocated. Two workers bci-work and bci-current worker dereference it. twl4030 bci remove disables charging and masks interrupts. It cancels neither worker. A...

PT-2026-90001

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

PT-2026-90429

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd setattr checks whether a size update needs NFSD MAY TRUNC before it takes inode lock. The comparison uses the file size sampled by that unlocked read, but the actual ATTR SIZE...

PT-2026-90427

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN ON ONCE from nfsd mode check The header for commit e75b23f9e323 "nfsd: check d can lookup in fh verify of directories" details the assumption that justified adding the WARN ON ONCE to nfsd mode check, tha...

PT-2026-90162

In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xa store failure iommufd take all iova rwsem takes an object reference and the iova rwsem write lock before storing the IOAS in the temporary ioas list xarray. If xa store fails, the current IOAS...

PT-2026-90335

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GET REPORT response to the caller buffer quickspi hid raw request receives the caller's buffer length in len, but quickspi get report never sees it and copies the whole device-supplied...

PT-2026-90485

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp setup state error path When cpuhp setup state fails after pit clockevent per cpu init has successfully called request irq, the error handling jumps directly to out pit clocksourc...

PT-2026-89999

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...

PT-2026-89896

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std. deserialize. These deserializers are registere...

PT-2026-90410

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD CANCEL path clp != NULL, manage cpntf state freed the target cpntf state without checking ownership. The lookup key st-si opaque.so id is allocated...

PT-2026-89755

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the bold timeline item shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attribute...

PT-2026-90331

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page lcns index by the log record The copy lcns loop and the redo shorten loop index page lcns at j + i, where i runs up to the log record's lcns follow. That count is checked only against the record's own length,...

PT-2026-89862

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

PT-2026-90532

🇸🇪 https://t.co/leuyjDktOF Cpp daily: 24h + upcoming 🎥 3 videos 📝 3 blogs 🚀 4 releases 🎙️ 1 podcast Random 📝 pick: Security advisory: CVE-2026-19248: Unbounded ... https://t.co/uD1WmIRicq...

PT-2026-90008

Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

PT-2026-89678

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

PT-2026-90202

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd rcvr in ipmi destroy user Commit 9e91f8a6c868 "ipmi:msghandler: Remove srcu for the ipmi interfaces list" dropped the synchronize rcu between unlinking the command receivers from intf-cmd rcvrs and...

PT-2026-90323

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted key size in parse tag 3 packet parse tag 3 packet set encrypted key size from the Tag 3 packet body without bounding it against ECRYPTFS MAX KEY BYTES 64. When encrypted key size 64, decrypt...

PT-2026-90006

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

PT-2026-89764

PCRE2 before 10.48, on 32-bit platforms, has a pcre2 compile 32 integer overflow and resultant out-of-bounds write...

PT-2026-89768

In PCRE2 before 10.48, pcre2 serialize encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe...

PT-2026-89872

@BitcoinBrabant @TimDraper Antoine Riard, "Replacement Cycling Attacks," disclosure on Bitcoin-Dev and Lightning-Dev mailing lists, Linux Foundation, 20 October 2023. CVE-2023-40231, CVE-2023-40232, CVE-2023-40233, CVE-2023-40234. Not CTO to be fair. 😉...

PT-2026-89775

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...

PT-2026-90238

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isys register devices registers the V4L2 async notifier via isys notifier init. If a subsequent probe step such as isys fw log init fails, isys probe jumps to the ou...

PT-2026-90113

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smc switch conns smc switch conns takes a reference on the SMC socket before dropping lgr-conns lock, so the connection stays alive while the CDC slot is fetched: sock hold&smc-sk; read unlock...

PT-2026-90164

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detect intel iommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iom...

PT-2026-90151

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...

PT-2026-90169

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu call iopf notifier looks up the requester with pci get domain bus and slot, which returns a PCI device with its reference count incremented. Neither the successful iommu...

PT-2026-90431

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs uuid add file failure When nfs uuid add file races with nfs uuid put tearing down uuid-net, it returns -ENXIO without publishing nfl-nfs uuid via rcu assign pointer. nfs open local fh then enters...

PT-2026-89809

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required...

PT-2026-90493

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

PT-2026-89894

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1 V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync server daemon on TCP port 13136. The daemon...