PT-2026-122114

A CSS sanitization vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the fin...

PT-2026-122108

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation...

PT-2026-121906

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb get hash net in seg6 make flowlabel Since commit d58e468b1112 "flow dissector: implements flow dissector BPF hook" skb flow dissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee...

PT-2026-121868

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it. cherry picke...

PT-2026-122009

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc getname smc getname dereferences smc-clcsock without holding clcsock release lock. Link-group termination can release the CLC socket through smc close active abort while the SMC socket is...

PT-2026-121938

In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation...

PT-2026-121963

In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt ns release drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotify mntns delete. That takes the mutex of...

PT-2026-122137

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions...

PT-2026-121841

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sev platform init handle init ex path calls rmp mark pages firmware with locked=false while the parent function of init ex path already acquired the sev cmd mutex. In t...

PT-2026-121832

Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust...

PT-2026-122112

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox too...

PT-2026-122051

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made ip rt update pmtu update every path. For nexthop objects, fib info num path and fib info n...

PT-2026-122066

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14...

PT-2026-122006

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5 tc matchall replace allocates a struct sparx5 mall entry for every offloaded matchall filter and adds it to sparx5-mall entries. sparx5 tc matchall destroy removes the entry...

PT-2026-122053

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

PT-2026-121856

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer read waits for the HDMI I2C transaction to reach I2C TRANSACTION DONE, but it ignores both timeout and signal returns from wait for completion interruptible timeout. If...

PT-2026-122142

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on...

PT-2026-121969

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may copy tree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

PT-2026-122094

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

PT-2026-121872

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm seq can look smaller than old, so .. covert to wrap-safe calculate way...

PT-2026-121842

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfs bmap typed handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

PT-2026-122046

In the Linux kernel, the following vulnerability has been resolved: Input: ati remote2 - fix type confusion in device attribute handlers Previously, the channel mask and mode mask attributes were registered on the parent usb device via sysfs create group. When commit b20d6bf8014b "Input:...

PT-2026-122113

Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata that causes entire session resume or entire checkpoint...

PT-2026-122065

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite ZCS allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When...

PT-2026-121956

In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...

PT-2026-121865

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hws table set default miss' API function, its miss tbl keeps the table that points to it in a list. If such table i...

PT-2026-122117

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...

PT-2026-121935

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs uring read extent endio If all bios finish before btrfs encoded read regular fill pages returns, it calls btrfs uring read extent endio and previously returned the I/O status. A...

PT-2026-121933

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io uring read extent fails btrfs uring read extent runs only after btrfs encoded read has taken the inode shared lock and the extent lock. On failure it used to unlock in out fail, an...

PT-2026-122061

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate dir takes the directory's i rwsem shared and holds it across -iterate shared. For a directory that never has an entry and is never removed the lock keeps nothing still...

PT-2026-122054

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

PT-2026-121877

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb write pointer with invalidate lock sb write pointer reads the super block from the block device page cache using read cache page gfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568...

PT-2026-121990

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso sock listen drops the socket lock before calling iso listen bis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore...

PT-2026-122034

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet fill frags fails When a response chain has more slots than fit in the skb's frags, xennet fill frags returns an error and xennet poll jumps to its error path. That path moves what's le...

PT-2026-122136

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5...

PT-2026-121889

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREAD SIZE ORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian...

PT-2026-122083

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

PT-2026-121907

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc wkalrm to prevent information leak The struct rtc wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC WKALRM RD ioctl, uninitialized kernel stack data...

PT-2026-121869

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype gc we need the rcu lock...

PT-2026-122119

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite ZCS allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without...

PT-2026-121925

In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink rel reference leak when notify work is pending devlink rel nested in notify work schedule takes a reference on the devlink rel for the notify work and then queues the work, ignoring the return value of schedu...

PT-2026-122069

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0...

PT-2026-121902

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When inject sigp stop is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread...

PT-2026-122143

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

PT-2026-122146

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...

PT-2026-122148

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1 FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

PT-2026-121843

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack expect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

PT-2026-121861

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211 rx mgmt deauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame...

PT-2026-121838

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=Tr...

PT-2026-121870

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc ioctl alloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so...