PT-2026-89913

SPIP before 4.4.18 contains a mass assignment vulnerability in the editer objet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champs editables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables...

PT-2026-90448

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f fs: Prevent deadlock during ep0 read loop Currently, ffs ep0 read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls wait event interruptible exclusive...

PT-2026-89877

An issue in Robotics-STAR-Lab SYSU STAR Group RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops publishing swarm trajectories when the drone enters IDLE...

PT-2026-90025

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

PT-2026-90244

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq pages arr...

PT-2026-90317

In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for IS SYNC inodes ext2 setsize and ext2 xattr set2 had a construct like: if IS SYNCinode sync inode metadatainode, 1; else mark inode dirtyinode; which leads to lost inode updates for IS SYNC inodes...

PT-2026-90380

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via op release nfsd4 decode createhow4 calls nfsd4 decode fattr4, which allocates refcounted struct posix acl objects via posix acl alloc and stores them in open-op pacl and open-op dpacl...

PT-2026-90345

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

PT-2026-90239

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel pending mlo pm work If the device is reset, suspended or unregistered within that window, the pending work can still run and access vif/bss data that may already be freed, or send MCU commands while the...

PT-2026-90234

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix this rq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Sever...

PT-2026-90245

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdr count read segments checks 4-byte alignment for non-zero position values but does...

PT-2026-89866

👨‍🍳 Progress Chef Automate: CVSS 10 critical. CVE-2026-80462 lets unauthenticated actors escalate privileges via the API gateway identity validation path under specific conditions. Patch immediately. cybersecurity ciso vulnerabilities mssp https://t.co/oK7C8H5CtZ https://t.co/JFDGm3roK7...

PT-2026-89780

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

PT-2026-90091

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset key num and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset key num drives cache kset crc and the replay loop in cache replay, the writeback worker and the GC...

PT-2026-90115

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smc llc rmt delete rkey and smc llc save add link rkeys read the part of a v2 message that does not fit into the 44-byte union smc llc msg, and both bound themselve...

PT-2026-90123

In the Linux kernel, the following vulnerability has been resolved: net: phylink: correctly validate returned PCS in phylink inband caps In phylink inband caps, the PCS returned by mac select pcs is only checked if NULL but mac select pcs can also return an error pointer. This can cause a kernel...

PT-2026-90480

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres release all calls Revocable::revoke via the release callback, whi...

PT-2026-90076

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuse uring copy to ring and req-out.h back in fuse uring commit. Both headers live inside the fuse request...

PT-2026-90377

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent post-shutdown use-after-free in unlock filesystem Writing a filesystem path to /proc/fs/nfsd/unlock filesystem runs nfsd4 cancel copy by sb before nfsd mutex is held and before the handler confirms that nn-nfsd serv...

PT-2026-90397

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK STRUCT PENDING before the callback is invoked, so delayed work pending in lm breaker timedout can return false while the fence worker is already...

PT-2026-90306

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocket job run In rocket job run, after taking an extra fence reference for job-done fence via dma fence get, the error paths have three bugs: - The dma fence reference held by job-done...

PT-2026-90165

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix dev iommu memory leak when device add fails in iommu mock device add iommu mock device add first calls iommu fwspec init, which on success allocates both dev-iommu via dev iommu get and dev-iommu-fwspec. If the...

PT-2026-90394

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsd direct write nfsd direct write walks a list of write segments and, after each vfs iocb iter write, tries to detect a short write so the loop can stop before placing the next segment at a...

PT-2026-90233

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix rq-core pick corruption under core scheduling Core scheduling's pick next task picks what to run on every SMT sibling of the core in a single pass under the shared core-wide rq lock. The selection state is consiste...

PT-2026-90215

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swap reader page callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

PT-2026-90450

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcg video init In uvcg video init, if kthread run worker fails, the error logged uses uvcg err, however, the pointer it uses: video-uvc is not assigned at this point, triggering ...

PT-2026-90503

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBL...

PT-2026-89903

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including...

PT-2026-90349

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce t2 coalesce t2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data area of tgt = char...

PT-2026-89757

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-90048

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

PT-2026-90491

TRC analysis reveals attackers exploiting MikroTik RouterOS vulnerabilities to compromise network infrastructure and pivot across segments. Missing authentication flaws CVE-2024-67277 and command injection CVE-2024-86060 enable total device control. Runtime segmentation helps contain...

PT-2026-90087

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: detect a cycle in the last-kset chain during replay cache replay follows the on-media last-kset chain by next cache seg id with no cond resched. A forged chain that points back into a segment it has already visited mak...

PT-2026-90090

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate on-media seg num against the cache device size seg num is read from the crc32c-only superblock, so whoever supplies the cache device on a table load CAP SYS ADMIN controls it. It sizes cache-segments and is th...

PT-2026-90157

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddet work already queued by the handler can still run after via sd remov...

PT-2026-90136

In the Linux kernel, the following vulnerability has been resolved: ipmi: Remove all sysfs files on registration failure ipmi add smi creates the nr users and nr msgs files before trying to create the maintenance mode file. If that last creation fails, the error path removes only nr users before...

PT-2026-90216

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu buffer::free page a buffer data read page Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf order for the free pages call. This mismatched order may crashes the...

PT-2026-90084

In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev-desc in i3c device get supported xfer mode i3c device get supported xfer mode uses dev-desc to obtain the master controller. However, dev-desc must not be dereferenced unless bus-lock is held,...

PT-2026-89791

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

PT-2026-90294

In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DM IO BIO requests, do region built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...

PT-2026-89798

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

PT-2026-89997

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

PT-2026-89888

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

PT-2026-90403

In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd file do acquire does not use a non-opened file -atomic open is permitted to return success without actually opening the file. It indicates this by calling finish no open. This means dentry create can return a fi...

PT-2026-89782

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

PT-2026-90235

In the Linux kernel, the following vulnerability has been resolved: sched ext: Replace SCX RQ BAL KEEP with a dispatch verdict return SCX RQ BAL KEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works...

PT-2026-89806

Dell patched critical Dell ObjectScale vulnerabilities, led by CVE-2026-70416. Fix these Dell ObjectScale vulnerabilities to stop remote code execution. DellObjectScale Cybersecurity CVE202670416 Vulnerabilities InfoSec https://t.co/MLbycde9pc https://t.co/1t9Iir3uo7...

PT-2026-90355

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs invalidate cache in cifs do truncate for O TRUNC cifs do truncate is invoked from cifs open without i rwsem, so it cannot use cifs resize file locked to perform a proper fscache cookie resize. Instead, add cifs...

PT-2026-89769

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing...

PT-2026-89874

NetBSD contains a use-after-free and double-free vulnerability in msg recv copyin within the COMPAT NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a...