2026

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on file creation due t

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl

In the Linux kernel, the following vulnerability has been resolved: btrfs: add missing RCU unlock in error path in try_

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050-core: fix pm_runtime error handl

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis: Fix NULL pointer dereference in adi

In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1780: fix PM runtime leak on error pa

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: hx9023s: Protect against division b

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue Th

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Eagerly init vgic dist/redist on vgic c

RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth

ZEBRA is a Zcash node written entirely in Rust. From zebrad versions 2.2.0 to before 4.3.1 and from zebra-rpc versions 1

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Or

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, a

Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication req

In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting (XSS) vulnerability was ident

Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incomin

PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child proce

Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor ric

Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, the

Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.

Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-u

Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber paramete

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions

SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endp

PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, reci

PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonai

PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL

PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (prais

PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw

PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools

SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new G

SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution in the new GINA UI be

SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the iden

SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which can be reached from th

SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the

In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before rea

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid uninit-value access in f2fs_sani

In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORD

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metad

In the Linux kernel, the following vulnerability has been resolved: ice: ptp: don't WARN when controlling PF is unavail

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring index not programmed for I

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix die ID init and look up

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_subset: Fix unbalanced refcnt in get

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Protect RNDIS options with mu

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound i

In the Linux kernel, the following vulnerability has been resolved: comedi: Reinit dev->spinlock between attachments to

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_ad

In the Linux kernel, the following vulnerability has been resolved: btrfs: reserve enough transaction items for qgroup