PT-2026-128205

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma cm destroy an id RDS still owns on route failure rds rdma cm event handler cmn hands the return value of rdma resolve route straight back to the rdma cm on RDMA CM EVENT ADDR RESOLVED. A synchronous...

PT-2026-128098

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix stall when a task enqueued with SCX ENQ LAST lands back on its CPU's local DSQ With SCX OPS ENQ LAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without SC...

PT-2026-128123

In the Linux kernel, the following vulnerability has been resolved: io uring/cancel: don't spin on local work the task can't run io uring cancel generic refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the nex...

PT-2026-127811

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticate user by email link function — hooked on the wp action and triggered b...

PT-2026-127812

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the...

PT-2026-127792

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg file upload function. This is due to the plugin performing file type validation via wp check filetype and wp check filetype and ext but never...

PT-2026-128288

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YAN...

PT-2026-128062

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privilege...

PT-2026-128248

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. auth middleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.can...

PT-2026-128161

In the Linux kernel, the following vulnerability has been resolved: mshv vtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshv vtl configure reg page warns and leaves that CPU's reg page NULL, but initial context setup...

PT-2026-128169

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling KV...

PT-2026-128171

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apf reason.flags until kvm handle async pf reads and clear...

PT-2026-128203

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocket probe stores the return value from rocket device init in the file-scoped rdev pointer before checking whether it is an error pointer. If rocket device init fails, rdev is lef...

PT-2026-128209

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus connection.conn state to DISCONNECTED prior to calling vmbus disconnect. But vmbus disconnect calls vmbus initiate unloa...

PT-2026-127828

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft,...

PT-2026-127914

Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

PT-2026-128124

In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the...

PT-2026-128125

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs sync sb buf xfs sync sb buf holds sb/rtsb buffer locks across a synchronous xfs trans commit, which flushes the CIL push workqueue internally. If shutdown occurs...

PT-2026-128129

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt dec pending crypt dec pending reads io-error before calling atomic dec and test. Another context, for example crypt endio called from an interrupt, may set io-error and drop its...

PT-2026-128132

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do tcp getsockoptTCP CONGESTION do tcp getsockopt reads icsk-icsk ca ops-name without holding rcu read lock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcp congestion ops in bpf", icsk ca ops can poin...

PT-2026-128139

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc info-start mmioaddr and later used by dmc load program. Unlike the MMIO address table, the firmware...

PT-2026-128140

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drm exec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before...

PT-2026-128143

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu gpr amdgpu debugfs gpr read drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label,...

PT-2026-128153

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffer meta for CPUs without a buffer The per cpu/cpuN/buffer meta files are created for every possible CPU, but buffer-bufferscpu is only allocated once that CPU comes online. Reading the file of a CPU...

PT-2026-128155

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-dev id. Fix a potential UAF by duplicating the...

PT-2026-128156

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check synth field, when a synthetic event field is a stacktrace field-is stack and the histogram field is not a "long" stacktrace array, validati...

PT-2026-128174

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs notify daemon takes a reference to the current notification pipe under wq mutex, then drops the mutex before writing the request. The write can block while the daemon...

PT-2026-128191

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owl emac probe calls owl emac phy init, which connects the PHY, before netdev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops...

PT-2026-128201

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttm bo type kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale...

PT-2026-128095

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate lock in ntfs setattr size ntfs setattr size updates i size and resizes the on-disk attribute without holding mapping-invalidate lock. Page faults take the lock shared, so a fault racing the resize can resolv...

PT-2026-128219

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate ...

PT-2026-128225

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized acces...

PT-2026-128101

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfs trim fs aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length down. When the free extent start is not...

PT-2026-128254

Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1...

PT-2026-127805

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web core/src/v0 9/basic catalog/expressions/expression parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

PT-2026-128222

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged...

PT-2026-128097

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scx bypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates onl...

PT-2026-128117

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix leak of uninitialized kernel data in SCLP report While report error write checks that the provided buffer is at least as large as the header struct, but not that it is large enough to contain the report with the...

PT-2026-127887

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users wp ajax nopriv that fail to...

PT-2026-128316

Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...

PT-2026-128325

Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability...

PT-2026-128318

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must...

PT-2026-127313

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web core/src/v0 9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed fro...

PT-2026-127790

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web core/src/v0 9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely...

PT-2026-127806

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

PT-2026-127743

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

PT-2026-127793

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2026-127796

Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers...

PT-2026-127795

Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate...

PT-2026-127794

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and r...