2026

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver

In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPI_COMPANION() against NULL d

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() in

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgx_speed_mb

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix double free in rvu_rep_rsrc_init(

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTL

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on A

In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup fa

In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in f

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_i

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_work leak on backbone_g

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs_extract_user_iter

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send

In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preempt_disable|enab

In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protection to lm90_alert Sa

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer bef

In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-onlin

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ Duri

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-ver

A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based autho

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Polen Media Softwa

The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builder

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that all

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the sys

Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to el

Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-R

Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenti

Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all pla

Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloa

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and ear

Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2

Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 20

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.

Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-

Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-

Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI,

Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-I

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs w