PT-2026-117155

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This expos...

PT-2026-116830

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpf crypto ctx create is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that params sz bytes of params are valid. The functi...

PT-2026-116771

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attach perf ctx data The attach perf ctx data can race on global and !global cases. The global case is protected by global ctx data rwsem and shares a single reference count using perf ctx...

PT-2026-117079

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssize t when checking hid bpf hw request As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to size t when...

PT-2026-116789

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst dev overhead The seg6, ioam6 and rpl lwtunnels size their skb cow head request as the length they are about to push plus dst dev overhead, then push the new headers and rebuild the m...

PT-2026-117154

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

PT-2026-116891

In the Linux kernel, the following vulnerability has been resolved: iio: adc: stm32-adc: fix possible division by zero in processed channel In case the conversion has failed or returned zero, processing val can lead to a division by zero. Need to check for errors, or converted value is zero, befo...

PT-2026-116949

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel pcie: reject oversized TX packets in send frame btintel pcie send frame eventually copies skb-data into a fixed BTINTEL PCIE BUFFER SIZE 4096 DMA buffer via memcpy in btintel pcie prepare tx, with a 4-byte PCIe...

PT-2026-117068

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcp newlink creates the UDP socket before register netdevice. If registration fails after pfcp dev init succeeds, the core calls pfcp dev uninit, which releases the...

PT-2026-116747

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpio desc to lineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later i...

PT-2026-116770

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perf clear branch entry bitfields clears the bitfields of struct perf branch entry one by one and leaves from/to alone, since callers overwrite those straight away. The list...

PT-2026-116914

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

PT-2026-116692

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

PT-2026-121197

Уязвимость функции VerifyCert системы управления Git-репозиториями Gitea связана с недостатками процедуры аутентификации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации...

PT-2026-116558

Name of the Vulnerable Software and Affected Versions PickPlugins Product Designer for WooCommerce WordPress plugin versions prior to 1.0.41 Description The plugin fails to perform capability checks and implements inverted nonce verification, which means it accepts requests with an invalid or...

PT-2026-116674

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM CONNINFO The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-sk state != BT CONNECTED && !rfco...

PT-2026-116661

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the net/sched: act ct component. This occurs when a raw pointer to the extensions area is added to the expectations list during the execution of nf c...

PT-2026-116734

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvif vmm dtor On failure, nouveau cli init calls nouveau cli fini to tear the client down. Then, nouveau drm open also enters into its cleanup path and calls nouveau cli fini AGAIN. nouveau cli fin...

PT-2026-116828

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm gem handle create fails virtio gpu gem create owns the reference taken by virtio gpu object create. On the drm gem handle create error path it calls drm gem object release instead of dropping...

PT-2026-116648

Name of the Vulnerable Software and Affected Versions @fastify/jwt versions prior to 10.2.5 Description In the top-level sign and verify methods, per-call options replace globally configured defaults instead of merging with them. This behavior causes any global default not explicitly restated in...

PT-2026-116994

In the Linux kernel, the following vulnerability has been resolved: nitro enclaves: fix use-after-free on SLOT ALLOC failure When ne create vm ioctl fails the SLOT ALLOC request after anon inode getfile has succeeded, the error path calls fputenclave file and then frees ne enclave. In normal...

PT-2026-117612

These are all security issues fixed in the rqlite-10.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116836

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn-napiidx % fbn-num napi; The issue is this is only correct in the cases where there ar...

PT-2026-116811

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emac tx mem map writes TX DESC 0 OWN into the ring descriptor for every slot beyond old head as soon as that slot's memset'd local copy is committed with "tx desc add...

PT-2026-116970

In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Drivers must handle this race, but TCSBRK and TCSBRKP should stil...

PT-2026-116799

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in accept queue lifecycle In nfc llcp socket release, sockets and listener accept queues are walked under the local sockets rwlock and bh lock sock. However, bh lock sock does not synchronise against...

PT-2026-117044

In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devm clk get error pointer in probe devm clk get&pdev-dev, "rtcref"'s return value was passed straight into clk get rate without checking it for an error first, unlike the "rtc" clock a few lines above...

PT-2026-116541

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The...

PT-2026-116647

A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read metadata from safetensors of the file modules/sd models.py of the component Extra-Networks Card Builder. Such manipulation of the argument metadata .sshs model...

PT-2026-116690

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed...

PT-2026-116551

The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment...

PT-2026-117161

A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument...

PT-2026-116908

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tb dp dprx work checks -dprx canceled before it takes tb-lock so it misses a tb dp dprx stop that could not cancel the already running work. It then polls the...

PT-2026-116903

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC FL KEEP SIZE fallocate emulation for small interior ranges in smb3 simple fallocate range issues FSCTL QUERY ALLOCATED RANGES and zero-fills...

PT-2026-116857

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvm vcpu init sve pkvm vcpu init sve clamps only the upper bound of the host-provided sve max vl, so an invalid vector length reaches sve state size from vl and the WARN ON there,...

PT-2026-117029

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211 monitor select queue ieee80211 monitor select queue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However,...

PT-2026-116955

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: Lock parent access during enhanced SCO setup Bluetooth: hci conn: Lock parent access during enhanced SCO setup hci enhanced setup sync runs on the request workqueue without the hci dev lock held by its caller...

PT-2026-116930

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment align size, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fra...

PT-2026-116957

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build pairing cmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

PT-2026-116960

In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detect usb format cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSi...

PT-2026-116724

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damon hugetlb mkold damon hugetlb mkold reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updat...

PT-2026-116548

The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer a...

PT-2026-116882

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprotected debugfs reads The firmware revision and firmware date file operations are open coded and never call debugfs file get, which debugfs create file unsafe requires. debugfs remove recursive...

PT-2026-116705

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena device init initializes the MMIO read mechanism with ena com mmio reg read request init, which allocates a coherent DMA buffer for MMIO read responses. The normal removal...

PT-2026-116765

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZR EL0 writes to EL2 init el2 fgt2 writes one mask to both HDFGRTR2 EL2 and HDFGWTR2 EL2. PMZR EL0 is write-only, so its trap bit, nPMZR EL0, exists only in HDFGWTR2 EL2 and is therefore never se...

PT-2026-116860

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so build prologue takes the exception cb path and never calls push callee regs. That is the...

PT-2026-116783

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530 remove common disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is on...

PT-2026-116537

A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated...

PT-2026-116867

In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uv secret list struct array only holds up to 85 items per page, resulting in an out of bounds read in find secret in page if the targeted...

PT-2026-117151

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSH TRUSTED USER CA KEYS and accepts arbitrary principals SSH AUTHORIZED PRINCIPALS ALLOW=anything, a user could...