acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

Important: Red Hat Security Advisory: acl security update

An update for acl is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

Important: Red Hat Security Advisory: acl security update

An update for acl is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

CVE-2026-77191: Missing Authorization

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window milliseconds to seconds between the completion of the authentication phase and the full enforcement of its assigned ACL...

PT-2026-91750

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...

Linux Distros Unpatched Vulnerability : CVE-2026-87106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory...

RHEL 9 : acl (RHSA-2026:67140)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67140 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfac...

CVE-2026-75943: Incomplete Cleanup

A brief milliseconds to seconds traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement...

PT-2026-91210

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

RHEL 9 : acl (RHSA-2026:67144)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67144 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfac...

PT-2026-91749

A brief milliseconds to seconds traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement...

CVE-2026-90934: Incorrect Authorization

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

CVE-2026-75944: Incomplete Cleanup

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...

RHEL 9 : acl (RHSA-2026:67142)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67142 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfac...

PT-2026-91751

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window milliseconds to seconds between the completion of the authentication phase and the full enforcement of its assigned ACL...

CVE-2026-89664

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When processing malformed NFSv4 OPEN compound operations that include valid Portable Operating System Interface POSIX Access Control List ACL attributes, the kernel fails to release allocated memory resources. This oversight...

Linux Distros Unpatched Vulnerability : CVE-2026-54258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-89671

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: gate nfs3 setacl by argp-mask nfsd3procsetacl calls setposixacl unconditionally for both ACLTYPEACCESS and ACLTYPEDEFAULT, passing argp-aclaccess and...

Linux Distros Unpatched Vulnerability : CVE-2026-89672

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in...