3627 matches found
CVE-2026-56155: Insufficient Granularity of Access Control
Insufficient granularity of access control in Active Directory Federation Services AD FS allows an authorized attacker to elevate privileges locally...
CVE-2026-50428: Out-of-bounds Read
Out-of-bounds read in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to disclose information locally...
CVE-2026-50684: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' in Active Directory Federation Services AD FS allows an authorized attacker to perform spoofing over a network...
PT-2026-58407
Name of the Vulnerable Software and Affected Versions Windows Container Isolation FS Filter Driver unionfs.sys affected versions not specified Description An out-of-bounds read in the Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to disclose sensitive...
CVE-2026-50324: Loop with Unreachable Exit Condition
Loop with unreachable exit condition 'infinite loop' in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...
CVE-2026-50411: Stack-based Buffer Overflow
Stack-based buffer overflow in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...
K000162230: Node.js vulnerability CVE-2026-21716
Security Advisory Description An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod and FileHandle.chown in the promises API without the required permission checks, while their callback-based equivalents fs.fchmod, fs.fchown were correctly patched. As a result, code running under...
CVE-2026-55781 NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not validate the fsfsize fragment size, allowin...
The vulnerability of the fs/xattr component in the Linux operating system’s kernel allows a hacker to cause a service failure.
The vulnerability of the fs/xattr component in the Linux operating system’s kernel is related to uncontrolled memory consumption. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-56466
Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.16 Description An issue exists in the ScopedFs component where the system validates the nearest existing ancestor of a dangling symlink as being within scope and subsequently follows that symlink during file...
CVE-2026-34153 Coolify LocalFileVolume fs_path command injection enables RCE
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fspath and parentdir values before validation, and submitFileStorage does not validate the...
CVE-2026-34153 Coolify LocalFileVolume fs_path command injection enables RCE
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fspath and parentdir values before validation, and submitFileStorage does not validate the...
CVE-2026-50135 Hugo: Symlink confinement bypass in resources.Get
Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat follows symlinks instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount e.g. a...
ROS-20260702-73-0009
The vulnerability of the ksmbdtreeconnlookup function in the fs/ksmbd/mgmt/treeconnect.c module of the SMB-server subsystem of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...
USN-8488-1 linux, linux-aws, linux-gcp, linux-ibm, linux-oracle, linux-realtime vulnerabilities
It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 Several security issues were discovered in the Linux kernel. An attacker could...
The vulnerability of the smb3_reconfigure() function in the fs/smb/client/fs_context.c module, which is part of the SMB client support in Linux kernel, allows a hacker to cause a service failure.
The vulnerability of the smb3reconfigure function in the fs/smb/client/fscontext.c module, which is part of the SMB client support in Linux kernel, involves improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2026-48935
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...
CVE-2026-48935
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...
CVE-2026-48935
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...
EUVD-2026-39608
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...