CVE-2026-89838: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as a length plus a fixed-size iname buffer. The buffer is not NUL-terminated, but recoverinode and recoverdentry print it with %s. For a 255-by...

CVE-2026-89823: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...

CVE-2026-89813: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. Its hw...

CVE-2026-89860: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework. INITWORK reinitializes the workstruct, resetting its list head and...

CVE-2026-89796: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamondmergeregions internal loop Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races", v1.1. Sashiko found a few issues in DAMON that could cause infinite loop, NULL...

CVE-2026-89857: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...

CVE-2026-89806: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fbsize calculation The framebuffer size calculation fbsize = linebytes height can overflow when both values are large e.g., 46341 46341 INTMAX. Since linebytes and height are both int...

CVE-2026-89802: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

CVE-2026-89849: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

CVE-2026-89803: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event before the fence context nouveauchanneldel tears the fence context down first and only drops the channel-kill subscription later, in the middle of the nvif object teardown: if...

CVE-2026-89915: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

CVE-2026-89784: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2026-89883: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregister rc device on probe failure After rcregisterdevice succeeds, later probe failures must undo the registration with rcunregisterdevice. The current error path jumps to the allocation cleanup label an...

CVE-2026-89776: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

CVE-2026-89895: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice sndcobaltcardcreate stores cobsc in sc-privatedata and installs sndcobaltcardprivatefree as sc-privatefree. From that point, sndcardfreesc releases cobsc through the ALSA card...

CVE-2026-89893: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netupciexit frees a netupcistate while its work item, netupreadcistatus, may still be pending or running on the system workqueue. The worker obtains the state with containerof...

CVE-2026-89774: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in scoconnready sk deref in scoconnready must be done either under conn-lock, or holding a refcount, to avoid concurrent close. conn-sk and parent sk is currently accessed without either, and...

CVE-2026-89781: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

CVE-2026-89887: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740remove function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a...

CVE-2026-89778: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofsuncompressblock's empty-block fast path returns pcount 17, so a crafted "ZF" Rock Ridge record can set it below PAGESHIFT; the bug is reached by an ordinary...

CVE-2026-89890: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007sndinit already takes a v4l2device reference for the ALSA side, but go7007sndremove drops it immediately after calling sndcardfreewhenclosed. That is too early when ...

CVE-2026-89837: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in findinlevel findinlevel gets a dentry folio with f2fsfinddatafolio before calling findinblock. If findinblock returns an error, the function stores the error in resfolio and breaks out of the loop...

CVE-2026-89028: Heap-based Buffer Overflow

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a...

CVE-2026-88910: Authorization Bypass Through User-Controlled Key

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

CVE-2026-89030: Missing Authorization

Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2ssearchuser AJAX handler in includes/Ajax/Get.php invokes B2STools::searchUser in includes/Tools.php, which returns the email address of every...

CVE-2026-88976: Improper Neutralization of Input During Web Page Generation

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs,...

CVE-2026-90042: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc ...

CVE-2026-89971: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme: skip the zoned limits update if the zone info query failed nvmequeryzoneinfo returns either a negative errno or a positive NVMe status code, but nvmeupdatensinfoblock only tests for the negative case: ret =...

CVE-2026-89981: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMIDEL1 when MTE is disabled cpuinfostorecpu gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE CONFIGARM64MTE=n or arm64.nomte. KVM sets HCREL2.TID5 ...

CVE-2026-90029: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: storage: realtekcr: fix use-after-free on disconnect realtekcrdestructor calls timerdelete before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a...

CVE-2026-89977: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe stores it and continues until initialization dereferences it through...

CVE-2025-59953: Deserialization of Untrusted Data

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server AsyncRPCServer in zmqrpc.py for supporting the RPC communications. In its core functionality callandresponse, I found i...

CVE-2026-82310: Insufficient Session Expiration

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-81869: Improper Handling of Unicode Encoding

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

CVE-2026-81326: Use of Hard-coded Cryptographic Key

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password...

CVE-2026-81872: Uncontrolled Resource Consumption

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

CVE-2026-76558: Improper Neutralization of Input During Web Page Generation

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-76556: Improper Neutralization of Special Elements used in an SQL Command

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

CVE-2026-76553: External Control of File Name or Path

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-76460: Incorrect Use of Privileged APIs

A vulnerability in an API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request ...

CVE-2026-76449: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76447: Missing Authentication for Critical Function

A vulnerability in the Online Certificate Status Protocol OCSP responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a...

CVE-2026-86338: Insufficient Granularity of Access Control

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...

CVE-2026-84905: Missing Authorization

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploadin...

CVE-2026-87028: Missing Authorization

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

CVE-2026-87076: Exposure of Sensitive Information to an Unauthorized Actor

Tanium addressed an information disclosure vulnerability in Discover...

CVE-2026-84997: Loop with Unreachable Exit Condition

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every...

CVE-2026-86107: Out-of-bounds Write

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...

CVE-2026-86443: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account...

CVE-2026-86475: Improper Input Validation

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked...