PT-2026-72568

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req id before indexing rsp pvcalls front event handler takes req id directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a stor...

PT-2026-72168

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous request firmware nowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...

PT-2026-72649

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk ctx Currently update sk ctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the...

PT-2026-72926

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb network may pull for transmit path header pulls In vxlan xmit, arp reduce, and vxlan mdb entry skb get, pskb may pull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB...

PT-2026-72216

In the Linux kernel, the following vulnerability has been resolved: mm/compaction: handle free pages prepare properly in compaction free free pages prepare can fail but compaction free does not handle the failure case. Failed pages should not be added back to cc-freepages for future use, since th...

PT-2026-72406

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file refcount leak on cached nlm do fopen failure The cached-file path in nlm lookup file reaches the found: label unconditionally, even when nlm do fopen fails. At that label result and file-f count are updated...

PT-2026-72483

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate irqchip index in irqfd routing Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chi...

PT-2026-72144

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six storage create wp user AJAX handler being registered on wp ajax nopriv six storage create wp user without any nonce, capability, credential, or ownersh...

PT-2026-72389

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

PT-2026-73047

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may b...

PT-2026-73051

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape table column width values, which allows injection into style attributes. An attacker can use the 'setAttrViewColWidth' AP...

PT-2026-73061

Name of the Vulnerable Software and Affected Versions code-projects Online Food Order System version 1.0 Description An issue exists in the edit food items.php file where manipulating the dname argument allows for cross-site scripting XSS, a technique used to inject malicious scripts into web pag...

PT-2026-72233

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sess key CIFS KEY...

PT-2026-72174

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR TO TP BUFFER and PTR TO BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

PT-2026-72231

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi alloc recv msguser takes the temporary user reference owned by the receive message, and ipmi free recv msg drops it again. If event delivery fails after allocating receive...

PT-2026-72676

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw add element group count found by syzkaller The original implementation caused an out-of-bounds memory access in the sdw add element group count for-loop when i == num. for i = 0; i ratesi && lane ==...

PT-2026-72978

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mr fault uevent emit mpi3mr fault uevent emit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP KERNEL allocations here, both the local kzalloc obj...

PT-2026-72491

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Validate notification payload size Validate MODULE NOTIFICATION payload length before reading bytes/channel data in control update handling...

PT-2026-73043

A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has bee...

PT-2026-73036

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build secret key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's...

PT-2026-72577

In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactivated when the bridge is put...

PT-2026-72705

In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test test xdp native adjst head grow data crashes when run on a bnxt machine and also crashes in NIPA. It seems that the bug is an underflow in bnxt rx multi page skb, which...

PT-2026-72585

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core honor vrm version in pmbus data2reg vid pmbus data2reg vid hardcoded the VR11 encoding regardless of the vrm version configured by the driver, while pmbus reg2data vid already switched on it. Any driver that...

PT-2026-72242

In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP NET ADMIN in the device netns for changelink ipip changelink operates on at most two netns, dev netdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other th...

PT-2026-73038

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...

PT-2026-72249

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssg ndo get stats64 unconditionally calls emac get stat by name with FW PA stat names regardless of whether the PA stats block is present on the hardware. emac get stat by name...

PT-2026-72371

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCK SCOPE SIGNAL bypass on the SIGIO path LANDLOCK SCOPE SIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery...

PT-2026-72325

In the Linux kernel, the following vulnerability has been resolved: xfrm: nat keepalive: avoid double free on send error nat keepalive send frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Onc...

PT-2026-72158

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' Button Code Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-72289

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a bug if the bio is out of limits If dm integrity check limits fails, the code would exit with DM MAPIO KILL. However, the range would be already locked at this point, and it wouldn't be unlocked, resulting in a...

PT-2026-72531

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation mlx5e hv vhca stats create is called from mlx5e nic enable, before mlx5e open. At that point priv-stats nch is still zero, because it is only ever incremented in mlx5e...

PT-2026-72544

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in cifs issue read Fix missing release of credits in the failure path in cifs issue read lest retrying the subreq just overwrites the credits value...

PT-2026-72415

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of num dests header Before the access to struct batadv tvlv mcast tracker's num dests, it is attempted to check whether enough space is actually in the network header. But instead of using...

PT-2026-72734

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the push to the pool fails. This prevents resources leak in case pool page allocation fails...

PT-2026-72753

In the Linux kernel, the following vulnerability has been resolved: ixgbe: do not configure xps for XDP queues netif set xps queue should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs =64, on E610 adapter, netdev is configured with...

PT-2026-72730

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internal codec mux put callbacks use the written enum value with snd soc enum item to val before checking whether the value is valid for the enumeration. Reject...

PT-2026-72762

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcim iomap region or devm kmemdup fail, the code returns directly without cleaning up previously allocated resources: - mt76 device allocated by mt76 alloc device - p...

PT-2026-72758

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996 mac write txwi 80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211 tx info. Check vif...

PT-2026-72626

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes pending and barrier reference leaks on discard failures raid10 make request acquires a writes pending reference with md write start before calling raid10 handle discard. Several failure paths in raid10 handl...

PT-2026-72479

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in try get locked pte Fix an unlikely race in try get locked pte, which could have happened if puds or pmds get unmapped between the p?dp get and p?d offset functions...

PT-2026-76438

These are all security issues fixed in the cargo-audit-0.22.2git0.281452c-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-73004

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devm hwmon device register with info has been called. At that time, data-hwmon dev is...

PT-2026-72306

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rx stamp/rx ifindex in bcm rx handler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcm rx handler can run...

PT-2026-72308

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm tx lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcm rx setup. Only copy the...

PT-2026-73008

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi tcp: Bound SCSI Response data segment to the connection buffer iscsi tcp hdr dissect receives the data segment of several PDU types into the fixed-size conn-data buffer, which is allocated for ISCSI DEF MAX RECV SE...

PT-2026-73021

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: widen NAT rewrite delta to s32 in sip help tcp sip help tcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more...

PT-2026-72161

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...

PT-2026-72778

In the Linux kernel, the following vulnerability has been resolved: kernfs: link kn to its parent before the LSM init hook After commit 12e9e3cd03b5 "simpe xattr: use per-sb cache", kernfs xattr set and kernfs xattr get compute the cache via kernfs rootkn before any other check. kernfs rootkn wal...

PT-2026-72783

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nf ct timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being us...

PT-2026-72802

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in change sta links for unready link ieee80211 set active links calls ieee80211 link use channel for each newly-added link and WARN ON ONCEs if it fails. The call uses assign on failure=true, which...