CVE-2026-90059: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: restore NETIPALIGN in the RX DMA offset Since the RX path was converted to zero-copy, the page pool page is handed to the stack directly as the skb head, and the offset the DMA engine writes at is what determines the...

CVE-2026-50125: Uncontrolled Resource Consumption

MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated getresource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource...

CVE-2026-54577: Improper Input Validation

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted localargv and localargc values but passed the original argument entry to auditpackage. When an operator or automation used an option such as -r before a package name, stale optind...

CVE-2026-45143: Improper Neutralization of Input During Web Page Generation

Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twi...

CVE-2026-54642: Cross-Site Request Forgery (CSRF)

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

CVE-2026-50291: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in...

CVE-2026-54918: External Control of System or Configuration Setting

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...

CVE-2026-93116: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: fix resource leaks on probe failure During driver initialization in asuswmiadd, various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration...

CVE-2026-90229: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-92476: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Initialize completion before requesting IRQ kmbocsaesprobe requests the device IRQ before initializing irqcompletion. Once the handler is registered it can run immediately, and ocsaesirqhandler unconditionally...

CVE-2026-90250: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90130: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vdpasim: fix cleanup after worker creation failure vdpasimcreate leaves vdpasim-worker as an ERRPTR when kthreadrunworker fails. The error path then drops the device reference, which releases the partially initialized simulator...

CVE-2026-93128: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lg-laptop: Fix LED resource handling The event notification callback might access kbdbacklight even when it was not successfully registered with the LED subsystem. The same happens inside acpiremove, where the LED...

CVE-2026-19477: Stack-based Buffer Overflow

There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux uldaq. This may result in information disclosure or arbitrary code execution. This vulnerability affects MCC Universal Library for Linux uldaq v1.2.1 and prior versions...

CVE-2026-78501: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

CVE-2026-93066: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpalock around large-page collapse Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes:...

CVE-2026-93142: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code accidentally calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call until later to avoid an error pointer...

CVE-2026-90151: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4allocclient allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the...

CVE-2026-90329: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: synchronize input before cleaning up a failed probe hiddeviceiostart allows reports to run concurrently with probe. If the probe subsequently fails, hiddeviceprobe releases driver resources and clears hdev-driver without fir...

CVE-2026-93195: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel The DisplayPort AUX channel gets initialized and registered during dwdpbind, but it is never unregistered, which may lead to resource leaks and/or use-after-free...

CVE-2026-90165: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90373: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear mt7915removeinterface cleared the wcid mask bit with no lock held and before clearing the RCU wcid pointer. The mask is a non-atomic RMW shared with the...

CVE-2026-92950: Insecure Default Variable Initialization

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses requirefilename to re-execute itself in the host realm, bypassing sandbox...

CVE-2026-69865: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-93141: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: r8a66597: avoid double free of ep0req in probe error path If usbaddgadgetudc fails, r8a66597probe jumps to erraddudc and frees ep0req, then falls through to cleanup2 where ep0req is freed again when it is non-NULL...

CVE-2026-90347: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

CVE-2026-63461: Exposure of Sensitive Information to an Unauthorized Actor

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden...

CVE-2026-93197: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: memcg: move LRU size accounting on reparenting instead of copying it When a memory cgroup is offlined its LRU folios are reparented to the parent. lruvecreparentlru splices the child's lists into the parent's and credits the pare...

CVE-2026-90402: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix controller cleanup on EDL sysfs failure mhiregistercontroller adds the controller device before creating the optional triggeredl sysfs file. If sysfscreatefile fails, the error path only drops the device...

CVE-2026-24074: Out-of-bounds Write

Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations...

CVE-2026-88792: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

CVE-2026-89879: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

CVE-2026-92596: Uncontrolled Resource Consumption

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the...

CVE-2026-20325: Improper Neutralization of Special Elements used in a Command

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-81642: Heap-based Buffer Overflow

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remot...

CVE-2026-27548: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27549: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27563: Improper Neutralization of Special Elements used in an OS Command

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-20247: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected...

CVE-2026-89955: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet been set. A concurrent read of the 'status' attribute can therefore ca...

CVE-2026-20286: Improper Authorization

A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-20344: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of...

CVE-2026-20360: Exposure of Sensitive Information to an Unauthorized Actor

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-20237: Improper Input Validation

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-89864: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...

CVE-2026-20194: Incorrect Resource Transfer Between Spheres

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20242: Deserialization of Untrusted Data

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...

CVE-2026-89816: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmcrtccommit leak if signaled when PAGEFLIPEVENT is used Commit 1c6ceeee6ebb "drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits" fixed a very similar issue when the event was allocated by...

CVE-2026-89822: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driverdata in i915pciprobe pcimatchdevice can return the dummy pcideviceidany entry when a device is force-bound via sysfs driveroverride, in which case -driverdata is unset NULL. i915pciprobe casts i...

CVE-2026-89800: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers the teardown to nouveauuvmmbindjobcleanup; it does not remove the...