CVE-2026-92507: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdeallocpduser When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-90205: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate orphan slot during inode read Patch series "ocfs2: validate active orphan slots during inode read". OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes. A corrupted slot can therefore index...

Google Chrome Vulnerability: CVE-2026-93374 Use after free in Dawn

Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-67071: Improper Removal of Sensitive Information Before Storage or Transfer

HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure valu...

CVE-2026-90228: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

CVE-2026-88952: Improper Authentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action...

CVE-2025-15697: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

CVE-2026-90234: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS server grants a delegation in an OPEN reply, nfsinodesetdelegation records it on the client. However, three of its error flows return without sending DELEGRETURN. A...

CVE-2026-82760: Inefficient Algorithmic Complexity

Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ashauthentication/base.ex splits its argument into one...

CVE-2026-92904: Incorrect Authorization

A flaw was found in the foremanremoteexecution plugin's template invocations controller. The showtemplateinvocationbyhost action resolves the job invocation by ID without evaluating the caller's viewjobinvocations permission filter against the record. An authenticated user whose job invocation...

CVE-2026-81637: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-86446: Exposure of Sensitive Information to an Unauthorized Actor

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken...

CVE-2026-25275: Buffer Over-read

Transient DOS when processing authentication frames with invalid FILS information element header lengths...

CVE-2026-90341: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboottablepopulate bounds checks limit individual entries to the mapped length. However, coreboottableprobe replaces the platform resource length with header and table siz...

CVE-2026-90383: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

CVE-2026-82759: Use of a One-Way Hash with a Predictable Salt

Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.haship/1 computes ...

CVE-2026-90211: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre on...

CVE-2026-54565: Exposure of Sensitive Information to an Unauthorized Actor

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

CVE-2026-90226: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mintu32, len, sizeofu32 only...

CVE-2026-90169: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...

CVE-2026-74005: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-92478: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

CVE-2026-90077: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: fix a resource leak in copynetns error handling path Currently, preinitnet does two things: 1 call nscommoninit which might fail 2 initialize resources which does not fail However, preinitnet is returning early when 1 fails,...

CVE-2026-90319: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...

CVE-2026-90171: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: release pending child sockets outside the handler lock smbdirectsocketdestroy releases the listener's pending/ready child sockets while still holding the listener's handler lock, the &idpriv-handlermutex taken via...

CVE-2026-90270: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: armmpam: Disable driver unbind to avoid UAF When a user unbinds an MSC and that MSC is the only MSC left for a component then the corresponding mpamcomponent will be freed. If the user then goes on to read the schemata file in th...

CVE-2026-93194: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Release core resources Core resources such as the DisplayPort AUX channel get initialized and registered during dwdpbind, but are never unregistered, which may lead to memory leaks and/or use-after-free:...

CVE-2026-92492: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreqcpuget returns NULL when no cpufreq policy is associated with the requested CPU, for example because the CPU is offline or the policy has already been torn...

CVE-2026-93109: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

CVE-2026-92992: Missing Authorization

A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...

CVE-2026-92939: Process Control

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

CVE-2026-90303: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...

CVE-2026-90314: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

CVE-2026-90273: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: missing cscfgcsdevdisableactiveconfig in perf enable In the perf enable path, there are missing cases where cscfgcsdevdisableactiveconfig is not called: - Branch broadcast is selected but not supported by the...

CVE-2026-11314: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-90213: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix memory leak in error path of buildtree In the error path of buildtree, node instances can remain in the local linked list when the function returns. Whenever an invalid value is detected in the self ID sequenc...

CVE-2026-92935: Improper Control of Dynamically-Managed Code Resources

vm2 is a sandbox for running untrusted Node.js code. In versions = 3.11.4 and = 3.11.6, the NodeVM constructor computes hasRealRequireConfig with typeof requireOpts === 'object' && requireOpts !== null, so an array-shaped require value for example require: satisfies the guard that is meant to...

CVE-2026-50022: Unintended Proxy or Intermediary

Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An...

CVE-2026-66676: Missing Authorization

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

CVE-2026-93080: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix transport device teardown lookup SCMI transport devices are deliberately excluded from normal SCMI bus matching so protocol drivers cannot bind to the internal transport children. However, scmidevicedestroy...

CVE-2026-90266: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS, btrfsdelayedrefsrsvrefill returns -EAGAIN whenever the over-committed metadata plus the zoneunusable bytes exceeds the usable size in a...

CVE-2026-92482: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: use devmgpiochipadddata for GPIO chip The gpiochip is allocated with device-managed memory but registered with the non-managed gpiochipadddata. This was harmless while the drivers were built-in, but once they c...

CVE-2026-55062: Improper Limitation of a Pathname to a Restricted Directory

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...

CVE-2026-90340: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: pinctrl: generic: free maps on pinctrlgenerictomap failure pinctrlgenerictomap parses DT configuration and allocates pinctrl maps via pinctrlutilsreservemap. If subsequent steps such as pinctrlutilsaddmapmux,...

CVE-2026-81516: Improper Handling of Exceptional Conditions

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A...

CVE-2026-90187: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

CVE-2026-90261: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btreewritepages start btreewritepages writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block gro...

CVE-2026-90370: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

CVE-2026-90365: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue in mt76freedevice, which runs after the hw is unregister...

CVE-2026-90328: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...