PT-2026-122084

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud...

PT-2026-122007

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb copy and csum bits When skb copy and csum bits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The calle...

PT-2026-122043

In the Linux kernel, the following vulnerability has been resolved: can: dev: init can skb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skb reset mac header/skb reset network header/ skb reset transport header calls from...

PT-2026-122070

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1...

PT-2026-121999

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

PT-2026-121909

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf event open currently gates perf allow kernel only on !attr.exclude kernel. However, users can still request kernel callchain collection with attr.exclude...

PT-2026-122110

A local privilege escalation vulnerability in the Zimbra Collaboration Suite ZCS MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. ...

PT-2026-122147

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF...

PT-2026-121936

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet req alloc p2pmem sgls assigns req-p2p dev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation...

PT-2026-122076

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10...

PT-2026-121945

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmp qrv set to 1 on the relay a tunnel lives for...

PT-2026-122052

In the Linux kernel, the following vulnerability has been resolved: rust binder: reschedule node refcount update on thread exit When a thread exits via BINDER THREAD EXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferr...

PT-2026-121998

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in of regulator bulk get all of regulator bulk get all returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply...

PT-2026-121845

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gsp: add SEC2 to GA100 chip table The booter-load and booter-unload firmware run on the SEC2 falcon. During tu102 gsp oneinit, the booter constructor needs device-sec2 to access the SEC2 falcon. Without the .sec2 entr...

PT-2026-121834

RPly through 1.1.4 contains an improper array index validation vulnerability in ply read header property that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply read list property call an out-of-bounds handler, crashing ASCII parsing or...

PT-2026-122045

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify dao clear left,right input functions" centralized the DAO input mapper clearing logic in dao clear input, but omitted the...

PT-2026-122022

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h free logical LAN on open-fail after register ibmveth open registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out free buffer pools without h free logical lan, so PHYP still owns the...

PT-2026-121858

In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBE HIT SS state. This can happen when tracing or perf code runs from the debug exception path while the first kprob...

PT-2026-122064

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SB FLAG DIRTY BITMAP flag set and the user activates the device in the 'R' mode, a crash in dm integrity resume happens becau...

PT-2026-121932

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io uring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfs uring encoded data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io uring does not free driver PDU...

PT-2026-121922

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of hlen in bpf flow dissect bpf flow dissect sanitizes the offsets returned by the BPF program with clamp tu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

PT-2026-122103

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...

PT-2026-122138

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function...

PT-2026-122038

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf detach When the driver is removed while the user space process that created the P2P device e.g. wpa supplicant is still exiting, the P2P device interface is removed twice and t...

PT-2026-121835

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and...

PT-2026-121880

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy to user failure If kfd dbg trap enable fails while copying runtime info to userspace, it had already activated the trap, set debug trap enabled, taken an extra process reference, and...

PT-2026-122028

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity info fsverity get info calls rhashtable lookup fast, which just uses rcu read lock and doesn't directly synchronize with fsverity remove info. For the same inode this isn't a...

PT-2026-121885

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2 video unregister device on driver removal The driver uses vb2 fop release as its file release operation, so vb2 video unregister device should be used instead of video unregister device during driver...

PT-2026-122005

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

PT-2026-122073

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1...

PT-2026-122072

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12...

PT-2026-122068

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0...

PT-2026-121967

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink submounts and mark mounts for expiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided ...

PT-2026-122023

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf state and its attached buffer should be freed. In the case of AF XDP ZC, the XSK buffer was not freed, leading to a...

PT-2026-122134

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...

PT-2026-121965

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN TREE NAMESPACE open treeOPEN TREE NAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

PT-2026-122030

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc node find by name returns a node after dropping its RCU read lock without taking a reference. The LINK SET, LINK GET and LINK RESET STATS handlers then lock and access the...

PT-2026-121948

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm add action or reset invokes the cleanup action immediately when registering the action fails. gpio exar probe currently stores the allocated ID in exar gpio only...

PT-2026-121946

In the Linux kernel, the following vulnerability has been resolved: net/sched: em text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in em text dump", which zero-initialised the dump-side struct. Sashiko pointed at a...

PT-2026-122126

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint /tasks/download/monitor.socket in goobi-viewer-core accepts download requests from unauthenticated users...

PT-2026-121873

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx mu isr imx mu shutdown imx mu xcr rmwpriv, IMX MU RCR, 0, IMX MU xCR RIEnpriv-dcfg-type, cp-idx; imx mu...

PT-2026-121961

In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir, unlink and rename call dont mount on the victim and then detach mounts with the victim's inode locked. do lock mount takes the inode lock of the mountpoint an...

PT-2026-122040

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data start run past the buffer struct dm ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dm ioctl, data, is seven bytes shorter than sizeofstru...

PT-2026-122086

A request attribute override vulnerability in Zimbra Collaboration Suite ZCS allows unauthenticated requests to /h/ to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch...

PT-2026-122101

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm:: execute subsequently applies rawurldecode to fullpath before...

PT-2026-122125

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy...

PT-2026-121875

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd queue acquire buffers was split off from set queue properties from user, set queue properties from criu was missed. Thus, set queue properties from criu is not...

PT-2026-121908

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-num stations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num stations' in 'struct ath11k' that did not...

PT-2026-122024

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached...

PT-2026-121855

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...