CVE-2026-90256: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...

CVE-2026-90371: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix RXDMADC buffer recycling race The RXDMADC buffers come from the RRO data queues' page pools, which are bound to a different NAPI, so the direct page-pool recycle used here could race the owning NAPI; take the...

CVE-2026-74002: Missing Authorization

Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...

CVE-2026-81446: Server-Side Request Forgery (SSRF)

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery SSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2026-92522: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: validate MADT IOAPIC entry bounds The IOAPIC hotplug lookup parses both MADT and MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generi...

CVE-2026-90051: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...

CVE-2026-93122: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uac: validate rate list length before storing UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UACMAXRATES...

CVE-2026-90312: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Check load-acquire src ptr type before the load checkatomicload calls checkloadmem before atomicptrtypeok. For a load-acquire that fetches into its own source register dstreg == srcreg, checkloadmem overwrites srcreg's type...

CVE-2026-8674: Reachable Assertion

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates...

CVE-2026-90235: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE xprtsock replaces and restores sk-skdataready and sk-skwritespace on live sockets with plain stores, and xsudpdosetbuffersize invokes sk-skwritespace via ...

CVE-2026-78425: Improper Authentication

Authorised users of outside applications behind the same corporate identity provider IdP, for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is...

CVE-2026-50608: Missing Authentication for Critical Function

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service...

CVE-2026-92504: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int3400: clean up ODVP on probe failures evaluateodvp creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The current unwind path only calls cleanupodvp from the late sys...

CVE-2026-93063: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: check SAP message length before reading it Verify the SAP message size is not larger than the local buffer before reading the message to avoid buffer overflow...

CVE-2026-25283: Stack-based Buffer Overflow

Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size...

CVE-2026-93165: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

CVE-2026-81440: Use of Hard-coded Credentials

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-93127: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

CVE-2026-81439: Incorrect Authorization

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass...

CVE-2026-93074: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

CVE-2026-92757: Missing Encryption of Sensitive Data

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-93054: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd, the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, uioregisterdevice unwinds the device but leaves idev-info...

CVE-2026-90207: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

CVE-2026-92933: Exposure of Sensitive Information to an Unauthorized Actor

vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...

CVE-2026-93099: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix UAF from worker threads when domains are removed The mbmhandleoverflow and cqmhandlelimbo workers read event counters and may sleep while doing so. They are scheduled via delayedwork embedded in struct...

CVE-2026-90280: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

CVE-2026-90251: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

CVE-2026-90180: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVEPENDING before entering mtiphwioctl. Removal can set that bit immediately afterwards and free dd-port in mtiphwexit while an ioctl still...

CVE-2026-90073: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhfchange to avoid overflow hhfinit sets q-quantum = pschedmtuqdiscdevsch with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes weight...

CVE-2026-90098: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

CVE-2026-93118: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf, so a failed...

CVE-2026-90238: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: fix self-deadlock in isp4sdpwronandinit error path isp4sdpwronandinit holds opsmutex via guardmutex and, on any init failure, jumps to errdeinit and calls isp4sdpwroffanddeinit. That helper takes the same...

CVE-2026-93179: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

CVE-2026-93187: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Return error for invalid number of formats When the number of input or output formats is zero, sofipc4widgetsetupcompsrc and sofipc4widgetsetupcompasrc print an error and jump to the cleanup label. At th...

CVE-2026-66575: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...

CVE-2026-66618: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Maps = 4.9.9 versions...

CVE-2026-93156: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - fail ahash requests on HASH idle timeout rkhashrun waits for RKCRYPTOHASHSTS to become idle after the final DMA transfer, but ignores the poll result. If the hash engine never becomes idle, the driver still reads...

CVE-2026-54596: Improper Neutralization of Special Elements used in an SQL Command

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-90411: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: unmap cmdiu DMA on rspiu mapping failure in initrequest nvmefcinitrequest maps cmdiu and then rspiu for DMA. If the rspiu mapping fails, the original code only recorded the error and fell through: it left the...

CVE-2026-93115: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: Check ACPICOMPANION against NULL Every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, so platform drivers that rely on...

CVE-2026-90065: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: release the internal TCP sock on IPPROTOSMC socket creation failure IPPROTOSMC sockets create an internal TCP sock "clcsock" from the proto-init hook. When socket creation fails after proto-init has run - e.g. a cgroup B...

CVE-2026-90202: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warni...

CVE-2026-90272: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: perf: armpmuv3: Zero initialize hwid branch stack field PERFSAMPLEBRANCHHWINDEX is supported by BRBE so hwid is passed to userspace, but it's never set by the BRBE driver. Zero initialize it as it should be according to the docs:...

CVE-2026-93014: Improper Limitation of a Pathname to a Restricted Directory

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-92919: Improper Limitation of a Pathname to a Restricted Directory

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-90221: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-85077: Improper Neutralization of CRLF Sequences in HTTP Headers

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

CVE-2026-66631: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

CVE-2026-90212: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

CVE-2026-79752: Improper Neutralization of Special Elements used in an SQL Command

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...