PT-2026-128205

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma cm destroy an id RDS still owns on route failure rds rdma cm event handler cmn hands the return value of rdma resolve route straight back to the rdma cm on RDMA CM EVENT ADDR RESOLVED. A synchronous...

PT-2026-128098

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix stall when a task enqueued with SCX ENQ LAST lands back on its CPU's local DSQ With SCX OPS ENQ LAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without SC...

PT-2026-128123

In the Linux kernel, the following vulnerability has been resolved: io uring/cancel: don't spin on local work the task can't run io uring cancel generic refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the nex...

PT-2026-128190

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xx eth probe connects the PHY before dev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need ops lock since the commit ...

PT-2026-128204

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKF NET OFF and SKF LL OFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting...

PT-2026-127811

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticate user by email link function — hooked on the wp action and triggered b...

PT-2026-127812

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the...

PT-2026-127792

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg file upload function. This is due to the plugin performing file type validation via wp check filetype and wp check filetype and ext but never...

PT-2026-127788

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp product producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes...

PT-2026-128238

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...

PT-2026-127857

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-128126

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucv sock recvmsg sends the HiperSockets-only AF IUCV FLAG WIN without testing the transport, so on a classic z/VM socket iucv send ctrl sizes the skb through a NULL iucv-hs dev. SO MSGLIMI...

PT-2026-128288

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YAN...

PT-2026-128241

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Stored XSS.This issue affects WP Discussion Board: from n/a through 2.6.0...

PT-2026-128062

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privilege...

PT-2026-128248

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. auth middleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.can...

PT-2026-128161

In the Linux kernel, the following vulnerability has been resolved: mshv vtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshv vtl configure reg page warns and leaves that CPU's reg page NULL, but initial context setup...

PT-2026-128169

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling KV...

PT-2026-128171

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apf reason.flags until kvm handle async pf reads and clear...

PT-2026-128177

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocket remove decrements rdev-num cores for each core it removes, while find core for dev searches slots 0 to num cores - 1. Unbinding the cores in the order they were...

PT-2026-128187

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash greth of probe calls greth mdio init, which connects the PHY, before dev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through...

PT-2026-128188

In the Linux kernel, the following vulnerability has been resolved: net: ethoc: move setting of netops to fix crash ethoc probe calls ethoc mdio probe, which connects the PHY, before netdev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need...

PT-2026-128192

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04 eth: Move setting of netops to fix crash hip04 mac probe calls of phy connect before ndev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need ops lock...

PT-2026-128193

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisi femac: Move setting of netops to fix crash hisi femac drv probe connects the PHY before dev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops through netdev need ops lock...

PT-2026-128203

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocket probe stores the return value from rocket device init in the file-scoped rdev pointer before checking whether it is an error pointer. If rocket device init fails, rdev is lef...

PT-2026-128209

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus connection.conn state to DISCONNECTED prior to calling vmbus disconnect. But vmbus disconnect calls vmbus initiate unloa...

PT-2026-127828

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft,...

PT-2026-128202

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xe evict flags switches on tbo-resource-mem type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was fre...

PT-2026-127914

Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

PT-2026-128124

In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the...

PT-2026-128125

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs sync sb buf xfs sync sb buf holds sb/rtsb buffer locks across a synchronous xfs trans commit, which flushes the CIL push workqueue internally. If shutdown occurs...

PT-2026-128127

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assoc dev local-assoc dev is shared between the association path and the association-response worker without common synchronization. mac802154 perform association stores the...

PT-2026-128128

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integrity metadata handles a discard, it fills a buffer with DISCARD FILLER and writes it over the tags, max blocks blocks at a time. If the kmalloc fails, the...

PT-2026-128129

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt dec pending crypt dec pending reads io-error before calling atomic dec and test. Another context, for example crypt endio called from an interrupt, may set io-error and drop its...

PT-2026-128132

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do tcp getsockoptTCP CONGESTION do tcp getsockopt reads icsk-icsk ca ops-name without holding rcu read lock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcp congestion ops in bpf", icsk ca ops can poin...

PT-2026-128137

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run deferred takes it, and the RCU callback that fre...

PT-2026-128139

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc info-start mmioaddr and later used by dmc load program. Unlike the MMIO address table, the firmware...

PT-2026-128140

In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drm exec object grabs a reference to the contended object, unlocks all other objects and pre-locks the contended one before...

PT-2026-128141

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu gem object close detaches the user queue eviction fence from the BO before it checks bo va-ref count, so closing any handle of a BO removes the fence, eve...

PT-2026-128143

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu gpr amdgpu debugfs gpr read drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label,...

PT-2026-128144

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocate usb4 bandwidth for stream and allocate usb4 bandwidth both use ASSERTstream-sink before dereferencing stream-sink-link. ASSERT is compiled out in...

PT-2026-128145

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response iscsi complete pdu fetches the task for five response types from one place and checks only that the index resolved: case ISCSI OP LOGOUT RSP: case ISCSI OP LOGIN RS...

PT-2026-128147

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse pdu itt A transport that implements parse pdu itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if i = session-cmds max i and cmds m...

PT-2026-128148

In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifront do response validates the rqid in a backend response against VSCSIIF MAX REQS before using it to index info-shadow, but then dereferences the entr...

PT-2026-128149

In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st remove and st open st remove drops the probe reference on the scsi tape with kref put and only afterwards removes its index from st index idr. If that was the last reference, scsi tape...

PT-2026-128153

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffer meta for CPUs without a buffer The per cpu/cpuN/buffer meta files are created for every possible CPU, but buffer-bufferscpu is only allocated once that CPU comes online. Reading the file of a CPU...

PT-2026-128155

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-dev id. Fix a potential UAF by duplicating the...

PT-2026-128156

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check synth field, when a synthetic event field is a stacktrace field-is stack and the histogram field is not a "long" stacktrace array, validati...

PT-2026-128174

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs notify daemon takes a reference to the current notification pipe under wq mutex, then drops the mutex before writing the request. The write can block while the daemon...

PT-2026-128175

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch count is smaller than blob-alh cfg.device count e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = ch...