PT-2026-89861

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

PT-2026-90243

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svc xprt put to free listener on create failure svc rdma create calls kfreecma xprt when svc rdma create listen id fails. svc xprt init has already acquired a net namespace reference via get net track; kfree bypasses...

PT-2026-90492

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features...

PT-2026-90223

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma write cm event ctx-file may only be changed under the handler lock and the xa lock, which is what stops uevents being queued for a ctx while ucma migrate id moves it to another file. The CM cor...

PT-2026-90191

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimit setup work while the threaded handler...

PT-2026-90209

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl used against rl count in refcount block validator ocfs2 find refcount rec in rl walks the on-disk refcount record array with: for ; i rf records.rl used; i++ rec = &rb-rf records.rl recsi; ... rl recs lives in ...

PT-2026-90103

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6fire comm receiver handler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

PT-2026-90228

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

PT-2026-90356

In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff t underflow in cifs remap file range when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = src inode-i size - off; If off i size, this is a negative loff t, corrupting the ByteCount i...

PT-2026-90457

In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in video register device" This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a. The intentions of that patch were good, but it doesn't work. The idea is that if device register...

PT-2026-90261

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq argp and rq resp free until after RCU grace period svc rqst free frees rqstp-rq argp and rqstp-rq resp synchronously via kfree, but defers the rqstp struct free via kfree rcu. After svc exit thread calls list del...

PT-2026-90291

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in build constructor string Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

PT-2026-90426

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs layout process forget path When the server returns a new layout stateid while a valid one is still held, pnfs layout process calls pnfs mark matching lsegs return on the on-stack free ...

PT-2026-90295

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloom map alloc has two 32-bit-specific problems when the computed bitmap reaches the U32 MAX fallback case. First, BITS TO BYTESU32 MAX is evaluated with 32-bit...

PT-2026-90481

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kernel old timeval contains a four-byte hole after tv usec because tv sec is 64-bit while kernel suseconds t is 32-bit. put itimerval fills...

PT-2026-90446

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in altera cvp send block dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

PT-2026-90402

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG ON in nfsd4 alloc layout stateid on racing delegation revoke nfsd4 alloc layout stateid reads fp-fi deleg file without holding fi lock when the parent stateid is a delegation. A concurrent delegation revoke via the...

PT-2026-90441

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32 rx done appends each received CEC byte to rx msg.msg using rx msg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without...

PT-2026-90292

In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata take snap bumps the live superblock refcount and then dm tm shadow block allocates a new block for the metadata snapshot. If the subsequent dm sm inc block of...

PT-2026-90406

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc status UAF The rpc status netlink dumpit walks every in-flight svc rqst under rcu read lock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc...

PT-2026-90517

CVE-2026-90461 OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTPS Basic Authentication. https://t.co/ar9eeuKgWS...

PT-2026-90259

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpc clnt handle event and rpc clnt remove pipedir Normal client creation goes through rpc setup pipedir, which records clnt-pipefs sb, but the mount-event path in rpc clnt handle event calls rpc setu...

PT-2026-90275

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in nd label validate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. nd label validate bounds it against the config area size, but sizeof namespa...

PT-2026-90265

In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc pool for cpu svc set num threads spreads the requested threads evenly across the service's pools base = nrservs / sv nrpools. When a service runs fewer threads than it has pools -- e.g. an...

PT-2026-90469

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shrink lruvec I am seeing some rcu tasks stalls in the Meta fleet during reclaim. INFO: rcu tasks detected stalls on tasks: 0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idle cpu...

PT-2026-90320

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

PT-2026-90274

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still degraded being inverted in raid10 sync request Commit fe6a19d40ceb "md/md-bitmap: merge md bitmap start sync into bitmap operations" converted still degraded from int to bool, but inverted the assignment in t...

PT-2026-90186

In the Linux kernel, the following vulnerability has been resolved: power: supply: cros usbpd: Limit port counts to EC USB PD MAX PORTS Currently the cros usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number ...

PT-2026-90184

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8788-charger: fix use-after-free on remove lp8788 charger remove flushes charger work before unregistering the IRQs. An IRQ thread can queue charger work after flush work has returned. The work can then run after...

PT-2026-90098

In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: Check card index validity at probe Although mts64 driver has a check of the given devptr-id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead ...

PT-2026-90173

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASD DEFINE ATTR macro...

PT-2026-90121

In the Linux kernel, the following vulnerability has been resolved: net: ravb: serialize PTP clock teardown ravb ptp interrupt can race with ravb ptp stop and pass the clock to ptp clock event while ptp clock unregister is freeing it. This can lead to a use-after-free. Use READ ONCE and WRITE ONC...

PT-2026-90124

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow-mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure...

PT-2026-90543

Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...

PT-2026-90195

In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp endpoint bh rcv looks the association up only when chunk-asoc is NULL, and caches the result in chunk-asoc and chunk-transport without taking a reference. A pack...

PT-2026-90056

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2 oplock break noti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected...

PT-2026-90344

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd debug eeprom read trusts resp-raw data2 -- a length byte supplied by the device in its REPORT EE DATA reply -- clamped only to the caller's read count: re...

PT-2026-90546

Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...

PT-2026-90117

In the Linux kernel, the following vulnerability has been resolved: NTB: ntb transport: Reject oversized TX buffers ntb process tx handles an oversized buffer by calling tx handler with a NULL data pointer and returning success. ntb netdev therefore neither frees the skb in its completion callbac...

PT-2026-90502

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

PT-2026-90509

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

PT-2026-89771

An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag...

PT-2026-90021

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

PT-2026-90473

In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable folio handling sort folio has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follo...

PT-2026-89790

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and r...

PT-2026-89909

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

PT-2026-90461

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmap prepare Commit 651fdda8406d "relay: update relay to use mmap prepare" changed the mmap file operation to mmap prepare for relayfs, but the lockdown check in debugfs was not updated accordingly...

PT-2026-90229

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENT GET INFO stores guest-controlled num events sizeofeinfo in a 32-bit integer. On RV64, num events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates...

PT-2026-90525

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

PT-2026-90054

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...