A vulnerability in the Linux kernel's ath11k WiFi driver was resolved by ensuring the 'num_stations' counter is reset properly on hardware restart. Without this fix, multiple hardware restarts could cause the driver to refuse new station or mesh peer associations, leading to connectivity issues and kernel warnings.
A vulnerability in the Linux kernel's RTC driver was resolved by zero-initializing the struct rtc_wkalrm to prevent information leakage. The issue involved uninitialized kernel stack data in padding holes of the struct being exposed to userspace via the RTC_WKALRM_RD ioctl call. This could lead to unintended disclosure of kernel memory contents. The vulnerability has been fixed by initializing the struct at declaration, eliminating the risk of leaking sensitive information.
A vulnerability in the Linux kernel IPv6 segment routing code (seg6_make_flowlabel) was resolved by using skb_get_hash_net() to properly obtain a network pointer. The issue arose when seg6_make_flowlabel() was called with an skb lacking both skb->dev and skb->sk pointers, which could occur in specific network scenarios involving TIPC UDP bearers and IPv4 routes with seg6 encapsulation enabled. This was fixed by ensuring the function uses skb_get_hash_net() to retrieve the network namespace pointer correctly.
A use-after-free vulnerability in the Linux kernel's EDAC altera driver was fixed. The issue occurred in error paths of altr_edac_a10_device_add() and altr_portb_setup() where a dci structure was freed before unregistering IRQ handlers, potentially allowing IRQs to access freed memory.
A NULL pointer dereference vulnerability in the Linux kernel's SPI-NAND driver was fixed. The issue occurs when the device tree sets "nand-no-ecc-engine", causing the ECC engine pointer to remain NULL while the code dereferences it unconditionally, leading to a kernel oops during device probing. The fix introduces a helper function to safely check the ECC engine pointer before use.
A vulnerability in the Linux kernel's KVM s390 subsystem related to IRQ injection with SIGP Stop and Store Status has been resolved. The issue involved storing status information while holding a spinlock, which could cause faults due to writing into userspace. The fix changes the behavior to defer the status storage outside the spinlock context, preventing potential faults.
A vulnerability in the Linux kernel's MACsec driver was resolved by initializing the SecY component before registering the network device. The issue caused warnings and potential reporting of uninitialized SecY attributes during device registration, particularly when MAC offload was used over an LRO-capable lower device with IPv4 forwarding enabled. The fix involves reordering initialization steps to ensure SecY and related attributes are properly set before notifications are emitted.
A vulnerability in the Linux kernel's AMD display driver (drm/amd/display) related to improper handling of the optional stream->sink pointer in DPMS sequences has been resolved. The issue involved dereferencing a potentially null pointer without proper checks, which could lead to inconsistencies or errors. The fix replaces usage of stream->sink->link with stream->link, adds assertions where sink is required, and improves resource access consistency.
A vulnerability in the Linux kernel's BPF sockmap implementation caused double-counting of the copied_seq TCP sequence number during self-redirects of packets back to the same socket. This led to warnings and potential TCP receive buffer inconsistencies. The issue was fixed by changing the handling of self-redirect verdicts to avoid double advancement of copied_seq.
A vulnerability in the Linux kernel's filesystem code caused hung tasks when unmounting filesystems after disk removal. The issue stemmed from repeated scans of inodes during eviction, which could block unmount operations and trigger hung-task reports. A patch was applied to change the inode eviction process to avoid repeated scanning and ensure proper inode disposal without blocking. Testing confirmed the fix resolves the issue without introducing regressions.
A vulnerability in the Linux kernel related to the parisc architecture has been resolved by increasing the kernel stack size to 32 KB for 64-bit kernels. This change addresses kernel crashes caused by kernel stack overflows, which were observed during specific workloads such as building the Debian vtk9 package with gcc 17. The issue manifested as kernel panics triggered by low stack detection in interrupt handlers.
A denial of service vulnerability exists in libexpat through version 2.9.0 related to delayed detection of the Billion Laughs attack pattern. This vulnerability can cause the software to become unresponsive or crash when processing specially crafted XML input. The affected version explicitly noted is version 3.0 of the Microsoft product referencing libexpat. No CVSS score or detailed impact metrics are provided.
CVE-2026-115929 is a high-severity vulnerability in MongoDB Compass caused by improper certificate validation due to the inclusion of recoverable eMudhra intermediate CA certificates in the Electron runtime's TLS root certificate store. This issue is resolved by updating to Compass version 1.53.1, which includes Electron 44.9.1.
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.
One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
CVE-2026-115938 is a high-severity vulnerability in Craft CMS affecting versions 4.0.0 up to but not including 4.18.9, and 5.0.0 up to but not including 5.11.2. It involves improper neutralization of special elements in the template engine, allowing authenticated control panel users to exploit a sandbox bypass in Twig templates. This leads to leakage of the GeneralConfig::securityKey and enables offline computation of HMAC signatures, which can then be used to pass signed parameters to unsandboxed template rendering, potentially invoking native PHP callables.
CVE-2026-115937 is a high-severity vulnerability in the Craft CMS commerce-mollie plugin where the Mollie webhook endpoint fails to verify the association between two attacker-controlled parameters: commerceTransactionHash and id. This flaw allows an unauthenticated attacker with any paid Mollie payment ID from the merchant's account to mark arbitrary transactions as paid, regardless of the actual payment amount.
CVE-2026-115801 is an out-of-bounds read vulnerability in Kakao khaiii versions 0.1 through 0.4. It occurs in the khaiii::nn::Linear::open function within the JSON Config File Handler component. The flaw arises from improper handling of the hidden_dim/class_num arguments, allowing a local attacker with write access to the resource directory to cause an out-of-bounds read. This vulnerability affects unsupported versions of the product and has a medium severity score of 4.8. Exploit code has been publicly released, but exploitation requires local access and the ability to modify the resource directory, which is already a trusted input. The vendor notes that with such access, an attacker can alter analysis results even without exploiting this vulnerability.
CVE-2026-115935 is a high-severity code injection vulnerability in CraftCMS that allows authenticated non-admin users with control panel access to inject a new security key into the .env file via crafted API response headers. This enables the attacker to forge signed login redirects containing Twig system() callbacks, potentially leading to remote code execution. The vulnerability affects CraftCMS versions 4.0.0 up to but not including 4.18.9, and 5.0.0 up to but not including 5.11.2.
CVE-2026-115897 is a cross-site scripting (XSS) vulnerability in the yahoo serialize-javascript library prior to version 7.1.3. The issue arises because the function-source escaping logic fails to neutralize a bare closing-script prefix when attacker-controlled function source text ends exactly at that prefix. This can allow an attacker to inject live HTML elements into a page if they control the serialized function's source text, such as via a spoofed toString() method. The vulnerability has a low CVSS score of 2.1 and requires high attack complexity and partial user interaction. It is fixed in version 7.1.3.
CVE-2026-115895 is a high-severity code injection vulnerability in the capricorn86 happy-dom JavaScript library. Versions from 17.0.0 up to but not including 21.0.4 improperly validate named ESM import aliases, allowing attacker-controlled input to execute arbitrary code in the Node.js host process when enableJavaScriptEvaluation is enabled. This issue is a residual path from an earlier incomplete fix and is resolved in version 21.0.4.