Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the fs.realpathSync.native function. An attacker running malicious code within a restricted Node.js environment where --allow-fs-read is intentionally limited can exploit this missing check to verify file...

The vulnerability of the cifs_flock() function in the fs/cifs/file.c module of the Linux kernel file system allows a hacker to cause a service failure.

The vulnerability of the cifsflock function in the fs/cifs/file.c module of the Linux kernel file system is related to a memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `zonefs_i_size_write()` function in the `fs/zonefs/super.c` module of the Linux file system allows a attacker to access protected information or cause service interruptions.

The vulnerability of the zonefsisizewrite function in the fs/zonefs/super.c module of the Linux file system support module involves exposing confidential information. Exploiting this vulnerability could allow an attacker to gain access to protected information or cause service failures...

kernel security update

3.10.0-1160.119.1.0.19 - ext4: fix use-after-free in ext4orphancleanup CVE-2022-50673 Orabug: 39036029 - Squashfs: check return result of sbminblocksize CVE-2025-38415 Orabug: 39036029 - atm: clip: Fix infinite recursive call of clippush. CVE-2025-38459 Orabug: 39036029 - usb: core: config: Preve...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.6.2) +1876 more potentially affected by unknown CVE via tokio-fs (>=0.1.7, <=0.2.0-alpha.6)

tokio-fs CARGO version =0.1.7, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0 - actix-multipart-rfc7578 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0061...

`tokio-fs` is unmaintained

The tokio-fs crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

RUSTSEC-2026-0061 `tokio-fs` is unmaintained

The tokio-fs crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

BIT-CEPH-2025-52555 CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS

Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is tha...

AZL-80523 CVE-2026-33056 affecting package trident for versions less than 0.22.0-1

tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball...

AZL-83037 CVE-2026-33056 affecting package clamav for versions less than 1.5.2-2

tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball...

PT-2026-29075

The tokio-fs crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

CVE-2026-23265: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer in read,writeendio ----------- cut here ------------ kernel BUG at fs/f2fs/data.c:358! Call Trace: blkupdaterequest+0x5eb/0xe70 block/blk-mq.c:987 blkmqendrequest+0x3e/0x70...

The vulnerability of the btrfs_submit_compressed_read() function in the fs/btrfs/compression.c module of the btrfs file system in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the btrfssubmitcompressedread function in the fs/btrfs/compression.c file of the btrfs file system in the Linux kernel exposes confidential information. Exploiting this vulnerability could allow an attacker to cause service failures...

GHSA-XVX8-77M6-GWG6 OpenClaw: Sandbox `writeFile` commit could race outside the validated path

Summary In affected versions of openclaw, the sandbox fs-bridge writeFile commit step used an unanchored container path during the final move into place. An attacker racing parent-path changes inside the sandbox could redirect the committed file outside the validated sandbox path. Impact This is ...

PT-2026-27155

Summary In affected versions of openclaw, sandbox fs-bridge writes validated the destination before commit, but temporary file creation and population were not pinned to a verified parent directory. A raced parent-path alias change could cause the staged temp file to be created outside the intend...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the dev server configuration when server.fs.strict is set to false. An attacker can access sensitive files on the host system by sending crafted requests to the development server...

PT-2026-24182

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.25.0 Description The layout, render, and include tags are susceptible to arbitrary file access through absolute paths. This can occur when paths are provided as string literals or through Liquid variables,...

The vulnerability of the fs/fuse component in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the fs/fuse component in Linux operating systems is related to errors during thread blocking. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the fs/notify component in Linux operating systems allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the fs/notify component in Linux operating systems is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the `begin_new_exec()` function in the fs/exec.c module of the Linux kernel file system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the beginnewexec function in the fs/exec.c module of the Linux kernel file system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...