CVE-2026-66573: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetTabs = 2.3.3.1 versions...

CVE-2026-93203: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid CRC corruption due to parallel claim add batadvblaaddclaim is used to add claims and modify the backbone of claims for CLAIM frames from remote backbones and local packets. When it handles a claim, it needs...

CVE-2026-93055: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

CVE-2026-90283: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fillsuper failure hugetlbfsfillsuper allocates a hugepage subpool when size or minsize mount options are specified. hugepagenewsubpool may also reserve huge pages for minsize. If root dentry creation...

CVE-2026-50604: Missing Authentication for Critical Function

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be...

CVE-2026-93124: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs because of devicematchdriveroverride, so platform drivers that...

CVE-2026-90169: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...

CVE-2026-90328: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-93149: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

CVE-2026-54594: Improper Control of Interaction Frequency

OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording th...

CVE-2026-90286: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

CVE-2026-90265: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: defrag: fix deadlock between defrag and delalloc space reservation While running fsstress with autodefrag and flushoncommit, hit a deadlock due to the fact that defrag reserves delalloc space while it's holding dirty and...

CVE-2026-93161: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qatalgxtsreversekey expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary cryptoaesctx with...

CVE-2026-93046: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs was failing when passed UINTMAX, this in turn would lead to an out of bound access in the propert...

CVE-2026-66630: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in PublishPress Series = 3.1.3 versions...

CVE-2026-90291: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

CVE-2026-92956: Protection Mechanism Failure

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...

CVE-2026-90249: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

CVE-2026-90053: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

CVE-2026-90206: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix maxqid race between configfs and controller allocation The function nvmetsubsysattrqidmaxstore can race against nvmetallocctrl when a subsystem's maxqid limit is modified. Suppose maxqid is currently 64. If...

CVE-2026-90346: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: clean up color-change beacon data on errors nl80211colorchange calls nl80211parsebeacon for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly...

CVE-2026-93184: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslaudmix: rework runtime PM handling in probe After pmruntimeenable the AUDMIX block is powered off and stays suspended until the first runtime resume. Register writes issued between probe and the first resume e.g. from DA...

CVE-2026-93119: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: ljca: bound banknum in ljcaenumerategpio ljcaenumerategpio reads desc-banknum from the device and loops validpini = getunalignedle32... for i banknum. validpin holds only LJCAMAXGPIONUM / 32 = 2 entries. Two checks run befor...

CVE-2026-92482: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: use devmgpiochipadddata for GPIO chip The gpiochip is allocated with device-managed memory but registered with the non-managed gpiochipadddata. This was harmless while the drivers were built-in, but once they c...

CVE-2026-93194: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Release core resources Core resources such as the DisplayPort AUX channel get initialized and registered during dwdpbind, but are never unregistered, which may lead to memory leaks and/or use-after-free:...

CVE-2026-89036: Improper Neutralization of Argument Delimiters in a Command

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

CVE-2026-90365: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue in mt76freedevice, which runs after the hw is unregister...

CVE-2026-93143: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pmruntime refcount leak in ipu7resume ipu7resume calls pmruntimegetsync before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without...

CVE-2026-92963: Undefined Security Weakness

vm2 versions before 3.11.2 fail to properly restrict access to the VM2INTERNALSTATEDONOTUSEORPROGRAMWILLFAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals...

CVE-2026-92959: Protection Mechanism Failure

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-45140: Improper Limitation of a Pathname to a Restricted Directory

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...

CVE-2026-87786: Improper Neutralization of Input During Web Page Generation

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order...

CVE-2026-87935: Unrestricted Upload of File with Dangerous Type

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the adminrequesthandler function. This is due to missing authorization and file type validation in the adminrequesthandler function, which is reachable unauthenticated via...

CVE-2026-93169: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmpdma: fix race between runtime PM and device removal In zynqmpdmaremove, runtime PM was disabled only after checking state and doing a manual suspend. This can race with runtime PM in the remove/unbind rmmod path...

CVE-2026-90255: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

CVE-2026-92904: Incorrect Authorization

A flaw was found in the foremanremoteexecution plugin's template invocations controller. The showtemplateinvocationbyhost action resolves the job invocation by ID without evaluating the caller's viewjobinvocations permission filter against the record. An authenticated user whose job invocation...

CVE-2026-53679: Undefined Security Weakness

Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed...

CVE-2026-90343: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wirelessdev is still present in the driver. cfg80211leavelocked and cfg80211stoppd already do this before invoki...

CVE-2026-78426: Incorrect Authorization

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token...

CVE-2026-54587: Improper Link Resolution Before File Access

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp, ownership, and permission operations. A local attacker able to modify part of the target installation tree could use...

CVE-2026-92944: Protection Mechanism Failure

vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise wi...

CVE-2026-92508: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

CVE-2026-11314: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-90189: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk is built as a module, a racing mkdir + poweron from userspace can...

CVE-2026-80355: Cross-Site Request Forgery (CSRF)

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-93166: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: debug: fix off by on in rtw89ppdustr This comparison should be = to avoid an out of bounds access...

CVE-2026-28326: Use of Hard-coded Cryptographic Key

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key...

CVE-2026-93147: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-86788: Improper Neutralization of Input During Web Page Generation

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

CVE-2026-90194: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on deviceadd failures When deviceadd fails after acpidevicesetname has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplis...