CVE-2026-98480: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970astartup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's unwi...

CVE-2026-98703: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

CVE-2026-98533: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipebdevsetintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. Th...

CVE-2026-98775: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure When necreatevmioctl fails the SLOTALLOC request after anoninodegetfile has succeeded, the error path calls fputenclavefile and then frees neenclave. In normal userspace...

CVE-2026-98478: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...

CVE-2026-98436: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly...

CVE-2026-98585: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes rounduppowoftwo is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero ri...

CVE-2026-111876: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub...

CVE-2026-112013: Divide By Zero

libtta through 2.3 contains a divide-by-zero vulnerability in ttadecoderinitgetinfo that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the...

CVE-2026-98536: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

CVE-2026-112054: Divide By Zero

Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slicebytesdenom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schrodecoderparsetransformparameters an...

CVE-2026-98479: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-98741: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detectusbformat cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize...

CVE-2026-98669: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: serialize buffer teardown with mode claims Buffer-mode claims hold mlock to guarantee that the device remains in buffer mode until the claim is released. Normal buffer updates take infoexistlock followed by mlock in...

CVE-2026-98468: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

CVE-2026-98572: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was...

CVE-2026-98672: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: adc: stm32-adc: fix possible division by zero in processed channel In case the conversion has failed or returned zero, processing val can lead to a division by zero. Need to check for errors, or converted value is zero, befo...

CVE-2026-98635: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

CVE-2026-97204: Incorrect Authorization

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that...

CVE-2026-98613: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

CVE-2026-112018: Out-of-bounds Write

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...

CVE-2026-98667: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to...

CVE-2026-98813: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-112009: Out-of-bounds Read

smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashe...

CVE-2026-98439: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...

CVE-2026-98447: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

CVE-2026-98628: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After docheck returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

CVE-2026-112046: Loop with Unreachable Exit Condition

OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept and...

CVE-2026-98510: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-111601: Improper Neutralization of Input During Web Page Generation

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-109989: Improper Neutralization of Input During Web Page Generation

The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popupwidthunit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level acce...

CVE-2026-111920: Improper Privilege Management

Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser pkg/models/projectaccess.go, which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write...

CVE-2026-107274: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-103899: Improper Neutralization of Input During Web Page Generation

The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vatnumber' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-111891: Improper Privilege Management

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin...

CVE-2026-111893: Improper Privilege Management

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions wit...

CVE-2026-111918: Incorrect Authorization

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...

CVE-2026-111933: Observable Discrepancy

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111881: Integer Underflow (Wrap or Wraparound)

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111892: Improper Restriction of Excessive Authentication Attempts

phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server...

CVE-2026-110889: Generation of Error Message Containing Sensitive Information

Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4...

CVE-2026-111919: Insufficient Session Expiration

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-109368: Missing Authorization

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private...

CVE-2026-81343: Missing Authorization

The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a...

CVE-2026-92978: Cross-Site Request Forgery (CSRF)

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

CVE-2026-111884: Use of Single-factor Authentication

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111902: Authorization Bypass Through User-Controlled Key

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read...

CVE-2026-100316: Improper Neutralization of Input During Web Page Generation

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-111922: Permissive Cross-domain Policy with Untrusted Domains

Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read t...

CVE-2026-96660: Improper Neutralization of Input During Web Page Generation

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to...