ALPINE-CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

EUVD-2026-58094

rsync tbefore 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns a...

CVE-2026-53798

CVE-2026-53798 affects rsync before 3.5.0. A privilege-confusion in the name-converter subprocess uid/gid mapping can let a local attacker cause transferred files to be owned by root. If the name-converter returns an empty uid/gid lookup (or signals fake super-user status), rsync may treat uid/gi...

CVE-2026-53798 rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

CVE-2026-53798 rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

PT-2026-71636

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A privilege confusion issue exists in the name-converter subprocess uid/gid mapping. Local attackers can cause transferred files to be owned by root by influencing the name-converter responses to retur...

CVE-2026-64602

In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "spearadcprobe in drivers/iio/adc/spearadc.c registers its interrupt handler with devmrequestirq before it initializes st-completion...

ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

SummaryHeap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read i...

CVE-2026-64499

A flaw was found in the Linux kernel's ti-ads1119 Analog-to-Digital Converter ADC driver. This vulnerability occurs during the buffer pre-enable process, where a Power Management PM reference is not properly released if an I2C communication error occurs. This oversight can lead to a resource leak...

CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-17500

A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function visitpattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance...

CVE-2026-17501 ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

CVE-2026-64501

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix CS held asserted and state leaks In adsigmadeltasingleconversion, setmodeADSDMODEIDLE and disableone were called from the out: block while keepcsasserted was still true. This caused any SPI transfer...

CVE-2026-64501

Summary of CVE-2026-64501 (Linux kernel, iio: adc: ad_sigma_delta) Multiple vendor advisories describe a vulnerability where CS (chip-select) could remain asserted and state leaks during SPI transfers in ad_sigma_delta_single_conversion and related error paths. The fixes move set_mode(AD_SD_MODE_...

GHSA-P893-RVQ9-2XF9 ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Summary Heap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read ...

CVE-2026-63936

A flaw was found in the Linux kernel's MediaTek MT6359 Analog-to-Digital Converter ADC driver. The mt6358readimp function does not properly check the return value of a read operation. If the read fails, an uninitialized variable is used, which can lead to the leakage of sensitive information from...

PYSEC-2026-2689 ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

Summary Null pointer dereference SIGSEGV in Upsample67::adaptupsample67 onnx/versionconverter/adapters/upsample67.h:31 when convertversion processes a model with an Upsample node that has zero inputs. The adapter accesses node-inputs0-sizes without checking input count. 107-byte PoC crashes on...