PT-2026-106344

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters...

PT-2026-106347

Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...

PT-2026-106570

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6 local rxpmtu and xfrm6 local error dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCP NEW SYN...

PT-2026-106571

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mapped len...

PT-2026-106577

In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpu name case sz and percpu name return case sz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will...

PT-2026-106581

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpm get nlmsg request iwpm get nlmsg request initializes refcount after list add tail making it accessible to global list where another CPU can kref get on nlmsg request causing a refcount "additio...

PT-2026-106587

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cpu timer::firing from a tristate value to a boolean. This lost th...

PT-2026-106589

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de thread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix cputimers. The task is looked ...

PT-2026-106608

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enable verity hits the qgroup limit, rollback verity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole...

PT-2026-106609

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: Disable IRQ on unbind Currently, struct xe i2c is freed before SGUnit IRQ is disabled in unbind path, leaving a potential UAF in case I2C IRQ is hit during this small window. Explicitly disable I2C IRQ in xe i2c remov...

PT-2026-106611

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommu tce check ioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommu tce check ioba. While doing so, the...

PT-2026-106613

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk-groups while lockless readers can use it netlink realloc groups uses krealloc under netlink table grab. Whenever NLGRPSZgroups lands in a different kmalloc bucket, the old bitmap is freed immediately. Two...

PT-2026-106614

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in vlan del could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL...

PT-2026-106639

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xe shrinker walk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which need...

PT-2026-106607

In the Linux kernel, the following vulnerability has been resolved: net: remove WARN ON ONCE from the dev fill forward path loop check ipip fill forward path and ip6 tnl fill forward path look up the route to the tunnel's remote endpoint and set ctx-dev to its device, which is the tunnel itself...

PT-2026-106643

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-private data before registering the PCM timer snd pcm timer init calls snd device register to link the new struct snd timer into the global timer list while it still carries hw.c resolution = snd pcm timer...

PT-2026-106528

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, add a new mask for controlling the source of the output voltage. Note...

PT-2026-106529

In the Linux kernel, the following vulnerability has been resolved: hwmon: hp-wmi-sensors Fix use-after-free in fungible show nsensor-current state is dynamically replaced as the sensor's state changes. update numeric sensor from wobj does this by freeing the old string and installing a new one: ...

PT-2026-106584

In the Linux kernel, the following vulnerability has been resolved: tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to the slow path, where tcp ack performs the appropriate validation and...

PT-2026-106586

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rds conn drop on protocol version mismatch rds ib cm connect complete runs from the RDMA-CM event handler with conn-c cm lock held. When the peer negotiates a protocol version older than RDS PROTOCOL COMPAT VERSION,...

PT-2026-106350

Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...

PT-2026-106390

A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploi...

PT-2026-106618

In the Linux kernel, the following vulnerability has been resolved: af unix: Unify scc index when finalising SCC in unix walk scc. Commit bfdb01283ee8 "af unix: Assign a unique index to SCC." changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint unix vertex.scc index...

PT-2026-106569

In the Linux kernel, the following vulnerability has been resolved: net: ip tunnel: initialize options len before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 encap ip id 300 geneve opts 4660:66:11223344...

PT-2026-106575

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Serialize local codec list cleanup hci dev close sync clears hdev-local codecs after releasing hdev-lock. Codec list additions and both traversals in sco sock getsockopt use that lock, but the close path does...

PT-2026-106579

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXP PNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXP PNFS out of nfsd4 setup layout type and into the callers. That patch didn't account for the new cal...

PT-2026-106300

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652 B20230116. The impacted element is the function firmware check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file name leads to os command injection. The...

PT-2026-106297

A flaw was found in SSSD. A local attacker with access to the Name Service Switch NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the...

PT-2026-106284

A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of...

PT-2026-106321

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has...

PT-2026-106291

A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipulation of the argument Doctor/appointment causes sql...

PT-2026-106307

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

PT-2026-106310

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

PT-2026-106312

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

PT-2026-106313

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors...

PT-2026-106413

Unauthenticated Cross Site Scripting XSS in Lumise Product Designer = 2.1.1 versions...

PT-2026-106593

In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: reset device before deleting virtqueues virtsnd remove and virtsnd freeze delete the virtqueues before resetting the device. del vqs frees the vring backing, but does not provide a generic device quiesce operation. ...

PT-2026-106415

Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...

PT-2026-106534

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct input absinfo: if copy from user&abs, p, min tsize t, size,...

PT-2026-106292

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

PT-2026-106289

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a deni...

PT-2026-106296

A flaw was found in sssd. A local attacker can cause a Denial of Service DoS by sending a crafted Pluggable Authentication Module PAM request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundari...

PT-2026-106521

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xx dxe deinit tears down the TX ack timer with timer delete, which only dequeues the timer and does not wait for a callback that is already executing; the...

PT-2026-106433

Employer / Sales Representative Arbitrary File Upload in Workreap Core = 3.4.5 versions...

PT-2026-106442

Unauthenticated Arbitrary File Upload in Doctreat = 1.7.0 versions...

PT-2026-106364

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials an...

PT-2026-106380

Unauthenticated PHP Object Injection in Haaken = 1.5 versions...

PT-2026-106420

Unauthenticated SQL Injection in Booknetic = 4.8.5 versions...

PT-2026-106535

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into response buf, which is CY MAX INPUT bytes...

PT-2026-106684

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if init path errors, the callee tries to clean up with rtrs clt close conns. However, this can lead to calling the event tracing code with clt path-kobj-name being NULL and...