CVE-2026-64395

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...

CVE-2026-64394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

CVE-2026-64394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

EUVD-2026-48938

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

CVE-2026-64388

Summary: CVE-2026-64388 affects the Linux kernel SMB client when using SMB3 POSIX Extensions, where chown/chgrp updates could be ignored unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID are also set. The root cause is a missing check for posix_extensions in cifs_setattr_nounix() during UID/...

EUVD-2026-48932

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

CVE-2026-64379 smb: client: mask server-provided mode to 07777 in modefromsid

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

PT-2026-64615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the ksmbd module contains a permission bypass. The smb2 set info sec function calls set info sec without performing a per-handle access check. This allows a client t...

PT-2026-64764

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.4.1 Description In the userspace dynamic-objects subsystem, the thread idx alloc function in kernel/userspace/userspace.c allocates a new thread permission index from the global thread idx map bitmap without holding...

PT-2026-64609

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Ownership and group modifications were ignored when mounting with SMB3 POSIX Extensions, unless CIFS MOUNT CIFS ACL or CIFS MOUNT MODE FROM SID were explicitly set. The issue occurs with...

GHSA-MHVJ-JHPQ-885V blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser http/src/main/java/org/http4s/blaze/http/parser/ cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration. Impa...

CVE-2026-60135

An attacker can modify data that should be restricted to read‑only access...

GHSA-RM67-G9CH-VXFF Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Affected software - Product: Poweradmin web front-end for PowerDNS - Version tested: master, commit 7f28c3a97 also reachable in the 4.x release line — the record-edit code is the same - Component: record editing web UI - Vulnerability type: Broken Access Control / Insecure Direct Object Reference...

GHSA-P279-2CQP-84JG OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIEDAUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIEDAUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...

GHSA-4QCJ-M5WP-JMF4 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

GHSA-W8X7-H2PX-XMQ8 Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

Summary GET /api/v4/user/search is available to any logged-in user. The service calls userClient.SearchActive, but despite its name that method filters only by email/nickname keyword and never adds a StatusActive predicate — while the sibling lookups GetActiveByID and GetActiveByDavAccount, defin...

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...