2026

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate num_subauth when copying ACE in set

In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on check_add_overflow() to

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs set_nt

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authoritie

In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in audit_dupe

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and conne

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Preserve rq tracking across local DSQ di

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asid_generation on CPU online to avo

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authent

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem`

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configu

entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buf

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networ

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. T

In the Linux kernel, the following vulnerability has been resolved: time/jiffies: Register jiffies clocksource before u

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe fa

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM di

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If *p

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to r

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush

In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when col

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: clear HCI_UART_SENDING when wr

In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: fix location monitor leak in tsi

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbd_vfs_kern_path_c

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attack

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI im

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authentic

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to acce

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to e

A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make t

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to d

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to que

A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attac

A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated us

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to cras

A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute a

An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Autho

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, crea

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execut

A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and down

A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker t

A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to injec