CVE-2026-90328: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

CVE-2026-93098: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that...

CVE-2026-93038: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: dac: ad5686: missing NULL check on match data Verify that chipinfo pointer is not NULL. If a user binds the driver using driveroverride via sysfs with a device name not present in the idtable or ofmatchtable, match data will...

CVE-2026-90350: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

CVE-2026-90182: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocgkickdelay turns sufficiently large debt into an explicit block-cgroup delay with blkcgsetdelay, setting blkg-usedelay to -1 and incrementing blkcg-congestioncount. Cleari...

CVE-2026-62108: Authentication Bypass by Spoofing

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-90094: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

CVE-2026-90355: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: clear stale link state on full reset After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996viflinkadd short-circuits when the linkid is still marked in...

CVE-2026-92520: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-90061: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: skip double clone set expressions on element insert Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This...

CVE-2026-93117: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when usbdynidslock is held, as removeidstore can free the node. Thus, make a copy in usbprobeinterface. Clarify the documentati...

CVE-2026-90243: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...

CVE-2025-55787: Improper Neutralization of Special Elements used in an SQL Command

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

CVE-2026-90293: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

CVE-2026-54594: Improper Control of Interaction Frequency

OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording th...

CVE-2026-93170: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious...

CVE-2026-81480: Stack-based Buffer Overflow

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-86038: Insufficient Verification of Data Authenticity

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips bindi...

CVE-2026-90366: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...

CVE-2026-93184: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslaudmix: rework runtime PM handling in probe After pmruntimeenable the AUDMIX block is powered off and stays suspended until the first runtime resume. Register writes issued between probe and the first resume e.g. from DA...

CVE-2026-90269: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

CVE-2026-85078: Inconsistent Interpretation of HTTP Requests

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controll...

CVE-2026-61793: Improper Input Validation

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /og/d/ route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParam...

CVE-2026-90249: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

CVE-2026-92524: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent leak in itsvpeirqdomainalloc When itsirqgicdomainalloc fails, the following itsvpeirqdomainfree fails to invoke itsvepteardown for the corresponding interrupt, which leaks the resource. Invoke...

CVE-2026-93169: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmpdma: fix race between runtime PM and device removal In zynqmpdmaremove, runtime PM was disabled only after checking state and doing a manual suspend. This can race with runtime PM in the remove/unbind rmmod path...

CVE-2026-66576: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

CVE-2026-90181: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ublk: avoid teardown retry loop on xarray allocation failure ublkshmemremoveranges removes matching maple tree ranges in batches, but first stores each range into a temporary xarray so that the pages can be unpinned after droppin...

CVE-2026-90338: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: keep console clock enabled for atomic writes pl011consolewriteatomic runs from nbcon atomic context, where sleeping is not allowed. It calls clkenable, which takes the common-clk enablelock. Under PREEMPTRT th...

CVE-2026-9314: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-90247: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

CVE-2026-90378: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: Fix memory leak in SDIO TX path When txprepareskb returns an error in the SDIO TX path, the skb is not freed, leading to a memory leak. This can occur when zero-length frames such as WNM NULL frames are droppe...

CVE-2026-90160: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modify the skb head and still return BPFOK, so bpfxmit rechecks the...

CVE-2026-93133: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Check acpigethandle status in riscvacpiaddprtdep In riscvacpiaddprtdep, the acpigethandle call can fail which would leave linkhandle uninitialized. Fix it by checking the acpigethandle return status and skip the ent...

CVE-2026-93085: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

CVE-2026-90056: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fecptpinit is only called when fep-bufdescex is available. However, fecprobe unconditionally calls fecptpstop on the failedinit path, and fecdrvremove unconditionally calls fecptpstop...

CVE-2026-90262: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

CVE-2026-90416: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-92495: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap bnxtremmap rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still retain VMMAYWRITE. nd later be upgraded with mprotectPROTWRITE. This ca...

CVE-2026-80355: Cross-Site Request Forgery (CSRF)

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-92986: Improper Neutralization of Input During Web Page Generation

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-90081: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

CVE-2026-92956: Protection Mechanism Failure

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...

CVE-2026-54446: Missing Authentication for Critical Function

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey...

CVE-2026-93146: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-90348: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...

CVE-2026-93178: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of...

CVE-2026-90144: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dplldeviceops during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpllpinonpinregister, the dpll object stays alive with an empty...

CVE-2026-90107: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...

CVE-2026-93062: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...