PT-2026-122148

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1 FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...

PT-2026-121843

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack expect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

PT-2026-121861

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211 rx mgmt deauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame...

PT-2026-121838

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with shell=Tr...

PT-2026-121870

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc ioctl alloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so...

PT-2026-121874

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm pm runtime enable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm runtime enable into the removal path instead doing it early. This...

PT-2026-121986

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm mutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

PT-2026-122105

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail messages/add/mailContentId.json endpoint accepts submissions without enforcing the form's auth captcha setting. BcMailControllerApiMailMessagesController::ad...

PT-2026-121923

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user regset copyin only copies count bytes, so a PTRACE SETREGSET request with a short iov len leaves the rest of the stack buffer uninitialized. In riscv vr set that...

PT-2026-121912

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-dai driver. When configuring a DAI with LPAIF I2SCTL MODE...

PT-2026-121863

In the Linux kernel, the following vulnerability has been resolved: firmware: arm scmi: Validate SENSOR UPDATE payload size SENSOR UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did...

PT-2026-121911

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap read lock ...

PT-2026-121837

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source id. Attackers can call the conversations create endpoint with another account's source id to create or retrieve...

PT-2026-122124

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force...

PT-2026-121905

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

PT-2026-122025

In the Linux kernel, the following vulnerability has been resolved: gve: fix napi disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napi disable and napi enable. However, the netdev lock has already been acquired before ndo bpf is...

PT-2026-121899

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested mmus array The nested mmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPU INIT for whole guest, which...

PT-2026-122109

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite ZCS allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty...

PT-2026-122021

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup ice dealloc dynamic port uses dyn port-vsi-idx to erase the dynamic port from pf-dyn ports. However, it frees the VSI before reading the index for the erase, resulting in a...

PT-2026-121950

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked list del in drm bridge add When re-adding a bridge that was previously removed, drm bridge add drops it from bridge lingering list without holding bridge lock. Both bridge list and bridge lingering list a...

PT-2026-122100

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to l...

PT-2026-121894

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad...

PT-2026-122099

Missing authentication for a critical function in the Android Debug Bridge daemon adbd in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell uid 2000, a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 no...

PT-2026-121851

In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu barrier in br multicast dev del This rcu barrier came from a time call rcu calls were used in net/bridge/br multicast.c. Now kfree rcu is there, we can remove this problematic rcu barrier which cause...

PT-2026-122128

Name of the Vulnerable Software and Affected Versions conda/conda versions prior to commit 9c0f238 Description An issue exists in the .github/workflows/update.yml workflow, which is triggered by issue comment events containing @conda-bot render or @conda-bot recreate. The workflow retrieves the...

PT-2026-122017

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add key race with keyring restriction key create or update snapshots keyring-restrict link before taking the destination keyring's semaphore. keyring restrict installs a restriction while holding that semaphore. This...

PT-2026-122081

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray pkg version OmegaConf resolver passing input to importlib.import module. Attackers controlling configuration values or command-line overrides can supply a ray pk...

PT-2026-122059

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvm memslot...

PT-2026-122047

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6 info hw flags set sizes the skb with rt6 nlmsg size and later fills it with rt6 fill node. With nexthop compatibility mode enabled, a concurrent replacement can grow the grou...

PT-2026-121903

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddev get ecc engine takes the NAND ECC ENGINE TYPE NONE path and returns success while leaving nand-ecc.engine NULL. The...

PT-2026-122003

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc transmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team xmit still returns NETDEV TX OK. ...

PT-2026-122097

OS command injection in the root-privileged 'hardware monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log logcat, which the helper reads and...

PT-2026-121883

In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf probe cavium ptp get acquires a reference to the PTP PCI device through pci get device. If any initialization step fails after cavium ptp get, the PTP PCI device reference is leaked...

PT-2026-122080

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0...

PT-2026-121846

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1x device init, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'...

PT-2026-121995

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIG SHADOW CALL STACK, handle exception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision wit...

PT-2026-122078

Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3...

PT-2026-122140

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $ r omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input string containing single-quote, redirect operator...

PT-2026-122122

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with auth.jwtSecret configured and a 2026-07-28-era client declaring elicitation.form support, a dispatch-gated tool call offered an inputRequired...

PT-2026-121973

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate mount busy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

PT-2026-121844

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...

PT-2026-122118

A missing authorization vulnerability in Zimbra Collaboration Suite ZCS allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the pro...

PT-2026-122033

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strp recv isn't running before tearing down the parser The comment above strp done claims that if strp is stopped, strp recv will no longer be called. That's only true if the caller has a mechanism eg locking...

PT-2026-121985

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty dev dereference in rfcomm dev shutdown syzbot hit a NULL pointer dereference in rfcomm dev shutdown when an RFCOMM tty is closed. rfcomm dev add puts the new device on rfcomm dev list first and onl...

PT-2026-121910

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request irq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

PT-2026-121958

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detach mounts on the entry with the inode locked and then call d delete once the inode is unlocked...

PT-2026-122002

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovs flow cmd dump calls ovs flow stats get f...

PT-2026-122129

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery strips Solr local-parameter syntax !... from user-supplied query strings before they reach Solr. Its regex can be bypassed by...

PT-2026-121924

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcp encap recv only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcp session recv then reads the 8 byte SEID that...

PT-2026-121892

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folio queue ENOMEM in writeback by adding a mempool" added a mempool for the folio queues and made the request, subrequest and folio...