CVE-2026-90267: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix specialvec mempool leak when scsiallocsgtables fails sdsetspecialbvec allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables fails afterward in sdsetupunmapcmnd or...

CVE-2026-90203: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk for example the offset into the decompressed fragment block, this will cause squashfscopydata to perform an out of bounds access. Fix by checking ...

CVE-2026-90348: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...

CVE-2026-90082: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: mana: Cap MSI-X vectors to the device MSI-X table size managdquerymaxresources sizes gc-nummsixusable from resp.maxmsix and the CPU count, but never from the device MSI-X table. On a 1792 vCPU M-series VM that yields 1793...

CVE-2026-90124: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

CVE-2026-90170: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

CVE-2026-90117: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate usaofs before preserving the update sequence number When ntfsmftrecordalloc reuses a free mft record it reads the old update sequence number straight from the on-disk record: usn = le16 u8 m + le16tocpum-usaofs; He...

CVE-2026-90352: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off dev-hif2, which is not assigned until after the IRQ setup. If...

CVE-2026-90367: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

CVE-2026-90086: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

CVE-2026-90319: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...

CVE-2026-90079: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix cn20k mailbox lifetime on repeated rvumboxinit rvumboxinit is called separately for AF-PF mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled. Each call used to allocate a new ngrvu object,...

CVE-2026-90161: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

CVE-2026-90147: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: clk: devres: fix cleanup in devmclkgetoptionalenabledwithrate devmclkgetoptionalenabledwithrate registers its cleanup action before setting the clock rate. If setting the rate fails, it attempts to disable and unprepare a clock...

CVE-2026-90143: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

CVE-2026-90103: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90132: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX xattrs Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAPSYSADMIN...

CVE-2026-90087: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

CVE-2026-90162: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2lock, mid-batch granted locks are published to connection-wide conn-locklist and file-wide fp-locklist lists immediately upon vfslockfile success, while...

CVE-2026-90137: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

CVE-2026-90099: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...

CVE-2026-90104: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

CVE-2026-90081: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

CVE-2026-93069: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix cleanup ordering Commit 173e02d67494 "OPP: Initialize scope-based pointers inline" added initialization for all pointers. In some cases, the ordering was changed so that opptable was initialized after opp. This also...

CVE-2026-25278: Time-of-check Time-of-use (TOCTOU) Race Condition

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying...

CVE-2026-52483: Undefined Security Weakness

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...

CVE-2026-50609: Improper Access Control

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, thi...

CVE-2026-54355: Improper Neutralization of Input During Web Page Generation

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTPXFORWARDEDHOST through msBuildOnlineResourc...

CVE-2026-90160: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modify the skb head and still return BPFOK, so bpfxmit rechecks the...

CVE-2026-54580: Improper Validation of Integrity Check Value

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...

CVE-2026-92515: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve unique-field state across nested structs btffindstructfield initializes a fresh seen mask for every recursive descent. Unique special fields in different levels of the same aggregate therefore do not see one another...

CVE-2026-92493: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active The crash issue may occur when modprobe amdpstateut on intel platform. amdpstateut: 1 amdpstateutacpicpcvalid success! amdpstateut: 2 amdpstateutcheckenabled...

CVE-2026-90434: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofsfillpages reads the compressed block pointer table. The error paths release the current bufferhead, the loop also releases the old bufferhead when it advances. However, the...

CVE-2026-90382: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a...

CVE-2026-54253: Improper Neutralization of Input During Web Page Generation

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connectport, host and returns the resulting error.message through...

CVE-2026-54546: Server-Side Request Forgery (SSRF)

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL in api/routes/basemap.ts to fetchurl without resolved-address...

CVE-2026-52836: Out-of-bounds Read

OpenDDS is an open source C++ implementation of the Object Management Group OMG Data Distribution Service DDS. Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes...

CVE-2026-93189: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: core: quiesce input in hidhwstop to prevent use-after-free A driver's probe calls hiddeviceiostart to enable input delivery, then fails at a later initialization step and unwinds via hidhwstop. The unwind frees struct hidraw...

CVE-2026-93132: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Fix riscvacpiaddprtdep loop handling The loop in riscvacpiaddprtdep includes error conditions that are handled in a dubious - if not outright wrong - way, by continuining the loop which skips and misses the entry...

CVE-2026-90126: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rtc: pcf8563: fix clock provider leak on unbind pcf8563clkoutregisterclk registers the CLKOUT clock provider with ofclkaddprovider, but nothing ever unwinds it: there is no ofclkdelprovider call and the driver has no remove...

CVE-2026-90289: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...

CVE-2026-66624: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...

CVE-2026-54521: Improper Neutralization of Input During Web Page Generation

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowliste...

CVE-2026-90068: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

CVE-2026-92525: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-93061: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-90297: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...

CVE-2026-90198: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix use-after-free in sndcarddofree A use-after-free was detected in sndcarddofree when a sound card managed by devres is unbound while a user-space application still holds an open file descriptor. For managed cards,...

CVE-2026-66571: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

CVE-2026-76154: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...