A reference leak vulnerability was identified and fixed in the Linux kernel's thunderx network driver (nicvf_probe function). The flaw involved a failure to release a reference to the PTP PCI device if initialization failed after acquiring it, potentially causing resource leaks.
CVE-2026-98911 is a high-severity vulnerability in the Linux kernel's dpaa2-switch component. It involves an incorrect error handling path in the dpaa2_switch_rx() function, where the wrong function is called to free frame descriptors, potentially leading to improper memory management. The issue is fixed by adjusting the error handling to correctly unmap DMA pages and free memory depending on whether an SKB was created.
A resource management vulnerability in the Linux kernel's Microchip Sparx5 driver was fixed. The flaw involved improper cleanup of PSFP (Per-Stream Filtering and Policing) resources during flower setup failures, which could lead to resource leaks. Specifically, if an error occurred after allocating stream gate, flow meter, and stream filter resources but before completing setup, these resources were not properly released. Additionally, a logic error in handling flow meter IDs could cause incorrect deletion attempts, leaving reference counts improperly incremented.
A vulnerability in the Linux kernel's lan966x network driver involves improper restoration of RX state after a reload failure. Specifically, certain fields related to RX page geometry and page pool registration are not restored correctly if resource reallocation fails, potentially causing inconsistencies in frame size handling in the XDP path. This issue has been fixed in specific Linux kernel commits.
A race condition vulnerability in the Linux kernel's imx mailbox driver was addressed by adding a channel shutdown field. The issue involved a timing window where the RX event could be re-enabled by an interrupt service routine while the shutdown process was waiting on free_irq(), potentially causing problematic interrupt handling and a 'nobody cared' message from the irq-core. The fix introduces a shutdown flag to properly serialize event enabling and prevent interrupts from being re-enabled during shutdown.
A vulnerability in the Linux kernel's mac80211 wireless subsystem was fixed by validating the length of deauthentication frames before accessing the reason code. The function ieee80211_rx_mgmt_deauth() previously read the deauthentication reason code without first confirming that the frame contained the required fixed field, potentially leading to improper memory access.
CVE-2026-77157 is a vulnerability in the Checkmarx ast-cli tool where helper binaries downloaded during operation were not verified for integrity before execution. This flaw allowed an attacker capable of compromising the download server to substitute malicious binaries, which could then be executed on developer machines or CI pipelines using affected versions. The vulnerability has been addressed by implementing SHA-256 checksum verification of downloaded archives prior to extraction.
CVE-2026-77156 is a path traversal vulnerability in the tar extraction logic of Checkmarx's ast-cli tool on Linux and macOS. It allows crafted tar archives containing absolute or traversal paths to write files outside the intended installation directory. Windows versions are not affected due to built-in path validation. The vulnerability requires an attacker to compromise the archive download source. The issue is fixed in version 2.3.51 by validating extraction paths to ensure they remain within the working directory.
CVE-2026-97328 is a Cross-Site Scripting (XSS) vulnerability in the WebP Express WordPress plugin versions before 0.25.16. The flaw occurs because the plugin does not properly escape values emitted into HTML element attributes by its bundled parser when a non-default image delivery mode is enabled. This allows unauthenticated users to inject malicious scripts that execute in the browsers of users viewing affected pages, including administrators.
A stored cross-site scripting (XSS) vulnerability exists in the Drupal Diba carousel slider module, affecting versions from 0.0.0 up to 3.0.2. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The CVSS score is 4.6, indicating a medium severity level.
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
A data race vulnerability exists in the RDMA transport of Apache bRPC versions prior to 1.18.0. This flaw allows a remote, unauthenticated client to cause a denial of service by crashing the server process when RDMA support is enabled both at build time and runtime. The issue arises from unsynchronized access to shared input buffers and parser state between TCP and RDMA message processing during the handshake and subsequent communication.
A security vulnerability (CVE-2026-114248) exists in the dhikshitha29 Insurance-Management-System affecting the Plan Management Form component. The vulnerability involves manipulation of the submit, Plan_no, and Name arguments in the /Admin/includes/AddNewPlan-inc.php file, leading to missing authentication. This flaw can be exploited remotely. The vulnerability has a medium severity with a CVSS score of 5.3. The project uses a rolling release model, so no specific affected or fixed versions are available. The issue was reported early but has not yet received a response or patch from the vendor. Public exploit details have been disclosed but no known exploitation in the wild has been confirmed.
IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:
* Certificate Authority (CA)
* Key Recovery Authority (KRA)
* Online Certificate Status Protocol (OCSP) Manager
* Token Key Service (TKS)
* Token Processing Service (TPS)
* Automatic Certificate Management Environment (ACME) Responder
* Enrollment over Secure Transport (EST) Responder
Security Fix(es):
* pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561)
* pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110)
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in libcurl's TFTP state machine allows a malicious TFTP server to manipulate the client's transfer mode. The state machine does not properly validate state transitions against the requested transfer direction, causing the client to accept server responses for both read and write operations interchangeably. This can lead libcurl to transmit unintended data from a reused handle, potentially leaking data from unrelated prior operations.
A stack-based buffer overflow vulnerability exists in the Mcli functionality of TOTOLINK X2000R firmware version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. This vulnerability can be triggered by an authenticated HTTP request, potentially allowing arbitrary code execution. The vulnerability has a critical severity with a CVSS score of 9.1.
ApostropheCMS versions prior to 4.34.0 and sanitize-html versions 2.18.0 before 2.18.1 contain an uncontrolled recursion vulnerability. This occurs when an <iframe> tag is disallowed and disallowedTagsMode is set to 'discard', causing recursive calls to sanitizeHtml without a termination condition. The flaw leads to a denial of service by exhausting resources. The issue is fixed in versions 4.34.0 of ApostropheCMS and 2.18.1 of sanitize-html.