168254 matches found
PT-2026-57461
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-57451
In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed...
Photon OS 3.0: Krb5 PHSA-2023-3.0-0624
An update of the krb5 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-3.0-0624. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
GHSA-48RX-C7PG-Q66R Excon does not redact additional sensitive/risky headers when following redirects
Impact The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip. What kind of vulnerability is it? Who is impacted? This could cause inadvertent leakage of sensitive data f...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: patch: patch-2.8-4.3.hum1 aarch64, x8664 patch-2.8-4.3.hum1.src src Security Fixes: patch: CVE-2026-56288...
patch: GNU patch: Denial of Service via specially crafted patch file
A flaw was found in GNU patch. An attacker can exploit this by providing a specially crafted patch file, which leads to a NULL pointer dereference. This improper handling of end-of-file markers can corrupt internal data structures, causing the utility to crash. This results in a denial of service...
FTP Fetch, Reverse All-Port TCP Stager
Fetch and execute an x86 payload from an FTP server. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options...
CVE-2026-55516
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/maintenanceid checks access to the current maintenance record and asset but then fills attacker-controlled fields including assetid without re-authorizing the newly supplied asset, allowing an...
EUVD-2026-42957
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not validate the fsfsize fragment size, allowin...
ROOT-OS-DEBIAN-13-CVE-2026-6276 CVE-2026-6276 in rootio-curl - Patched by Root
Root has patched CVE-2026-6276 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-3784 CVE-2026-3784 in rootio-curl - Patched by Root
Root has patched CVE-2026-3784 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...
EUVD-2026-34067
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user...
patchtriage
PatchTriage !CIhttps://github.com/d01ki/patchtriage/actio...
Security update for dracut
This update for dracut fixes the following issue CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: Update to version 059+suse.570.g2b84048d7: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...
ROOT-APP-NPM-GHSA-64G7-MVW6-V9QJ GHSA-64g7-mvw6-v9qj in @rootio/shelljs - Patched by Root
Root has patched GHSA-64g7-mvw6-v9qj in the @rootio/shelljs package for Root:npm. Multiple fixed versions available...
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers
A single wrong variable on one line in XQUIC, Alibaba's QUIC and HTTP/3 library, lets any remote client crash the server with a short burst of completely legal traffic. There is no patch. FoxIO researcher Sébastien Féry disclosed the flaw on July 8 and nicknamed it XRING. He says it needs no logi...
CVE-2026-14461 Out-of-bound read in mtr
mtr is vulnerable to Out-of-bound read vulnerability in ipinfolookup function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME...
ROOT-OS-DEBIAN-13-CVE-2026-1502 CVE-2026-1502 in rootio-python3.13 - Patched by Root
Root has patched CVE-2026-1502 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...
