PT-2026-116919

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info-band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee80211 8023 xmit does not set info-band from the channel context on non-MLD interfaces. It stays at 0, so ieee80211 get tx rates uses the...

PT-2026-116658

In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...

PT-2026-116864

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwing init ff passes the driver's private data, allocated with devm kzalloc in winwing probe, as the effect context to input ff create memless. The memoryless...

PT-2026-116553

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type,...

PT-2026-116858

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the Page Number and Page...

PT-2026-116616

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta decoder process stream and tta decoder process frame because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 wi...

PT-2026-116610

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL EXPORTER OTLP CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or...

PT-2026-116984

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize irq by waiting until its private callback usage counter drops to 0 with the private lock not held. This counter is...

PT-2026-117026

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5 module where the mlx5 handle changeupper event and mlx5 handle changeinfodata event functions incorrectly call bonding-specific APIs when handling team...

PT-2026-116722

In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf info completion for TX RING packets tpacket snd sends skbs with frags pointing into its ring slots. Slots are released when skb-destructor is called. A call to skb orphan calls skb-destructor before the skb is...

PT-2026-116725

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolve free hugetlb folio doesn't check hstate is gigantic no runtimeh though remove hugetlb folio/ update and free hugetlb folio silently bail for such folios,...

PT-2026-116620

Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into...

PT-2026-116972

In the Linux kernel, the following vulnerability has been resolved: tty: tty port: restore TTY IO ERROR on activation failure Make sure to restore the TTY IO ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel...

PT-2026-116650

Name of the Vulnerable Software and Affected Versions kishan0725 Hospital Management System versions prior to 777fda46b77a820977a5ba616283dbfbc40bf7e1 Description A remote SQL injection is possible within the Appointment Cancellation Handler component. The issue exists in the mysqli query functio...

PT-2026-117076

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip vs lblcr new and ip vs lblc new create cache entries for every previously unseen destination address. The table max size only tells the periodic collector to reclaim entries after the...

PT-2026-116883

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16400: fix unprotected debugfs reads adis16400 serial number fops is open coded and never calls debugfs file get, so debugfs remove recursive does not wait for a read in progress and unbind frees the iio dev...

PT-2026-116749

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobe sysctl mutex held, ...

PT-2026-116543

A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema name leads to missing...

PT-2026-116961

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client-ioctl mutex, but the translated port-info compat path invokes the same handlers through snd seq kernel client ctl...

PT-2026-116753

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy new policy audits the policy after ipe new policyfs node publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while ipe audit...

PT-2026-117152

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its...

PT-2026-116619

Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...

PT-2026-117074

In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add changeset property links a new property of a not-yet-live target node into the node's deadprops list before handing it to of changeset add property. If...

PT-2026-116988

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f uac1 legacy: validate bRequest index in generic set,get cmd generic set cmd and generic get cmd use the low nibble of ctrl-bRequest as an index into con-data: u8 cmd = ctrl-bRequest & 0x0F; / 0 .. 15 /...

PT-2026-116606

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create...

PT-2026-116963

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized stream config-type stream config is not initialized before being passed to sdw stream add slave. The type field may contain garbage and is later copied to stream-type by sdw config stream...

PT-2026-116814

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects to...

PT-2026-116587

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13...

PT-2026-117040

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB HAS METADATA leaves iocb-private as a uio meta, while iocb bio iopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdev direct IO, which never publishes...

PT-2026-117053

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd otp nvmem add unregisters the user device but leaves mtd-otp user nvmem set. On an error, the...

PT-2026-116603

Name of the Vulnerable Software and Affected Versions Vanus versions 0.8.0 through 0.9.0 Description An authentication flaw exists in the gateway CloudEvents HTTP receiver, allowing unauthenticated remote attackers to publish events to any eventbus. Attackers can bypass token authentication and...

PT-2026-116778

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcr port err smcr port err traverses smc lgr list.list without holding smc lgr list.lock, allowing a concurrent smc lgr terminate sched to free an lgr while it is still being dereference...

PT-2026-116948

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va align to hugetlb mappings on AMD F15h get align mask returns huge page mask align for hugetlbfs, but get align bits adds va align.bits regardless, so vm unmapped area returns an address off the huge page...

PT-2026-116684

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVM RUN. As a result, kvm riscv aia imsic rw attr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a...

PT-2026-116870

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in dat cond set storage key Some callers pass NULL as oldkey. Calling page cond set storage key will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the...

PT-2026-116649

A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...

PT-2026-117018

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpf tramp image put makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

PT-2026-116772

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofs kill sb When autofs fill super fails before clearing AUTOFS SBI CATATONIC for example, when find get pid fails on an invalid pgrp mount option, or when an fs context is closed...

PT-2026-116912

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tb stop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprx work still in flight which holds its own tunnel reference and t...

PT-2026-116776

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve can send tso for UDP GSO gve can send tso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in...

PT-2026-116798

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc genl llc sdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfc llcp send snl sdr...

PT-2026-116708

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd cons read The hardware can report an out-of-range tpd cons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would...

PT-2026-117016

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queue mapping when the tx queue is picked skbedit can set skb-queue mapping and raise the per-CPU skip txqueue flag so dev queue xmit honours the mapping. dev queue xmit cleared the flag before sch handle egress and...

PT-2026-117009

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perf event exit task and perf pending task A race condition exists between perf event exit task and perf pending task during begin new exec. During begin new exec, perf event exit task may be called, and th...

PT-2026-116653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A range check was missing in the proc dointvec ms jiffies minmax function within the sysctl component. This occurred because a previous update to replace the SYSCTL INT CONV CUSTOM macro...

PT-2026-117008

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free by rcu ttrace do call rcu ttrace returns early when call rcu ttrace in progress is set and leaves the objects in free by rcu ttrace. free rcu frees waiting for gp ttrace only and clears the flag...

PT-2026-116974

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc send ctl The stack-allocated struct vio vcc pkt was partially initialized, leaving the tag.stype env field uninitialized before being sent via ldc write, potentially leaking kernel...

PT-2026-116800

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc llcp recv dm nfc llcp recv dm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connecting sockets: it looks the socket up with nfc llcp connecting sock get...

PT-2026-116796

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc llcp wks sap nfc llcp wks sap compares only service name len bytes, so a short service name like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exa...

PT-2026-116596

Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5...