CVE-2026-96747: Server-Side Request Forgery (SSRF)

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

CVE-2026-93068

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-79994

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

CVE-2026-79994

CVE-2026-79994 affects the guest-to-host Unix-domain socket (UDS) forwarder in Docker Sandboxes . The relay validates that a socket path resides inside an authorized workspace but later reconnects using the raw pathname. A malicious guest can exploit a symlink race by replacing an intermediate di...

CVE-2026-79994 Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

CVE-2026-79994: Time-of-check Time-of-use (TOCTOU) Race Condition

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

Astra Linux – Vulnerability in Tomcat9

Check-time/use-time TOCTOU race condition vulnerability in Apache Tomcat: When creating Unix domain sockets, an unauthorized local user can access the Unix domain socket. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, and from 9.0.42...

BIT-TOMCAT-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.42 through...

K000163240: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-65183 Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...

OESA-2026-3592 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Access Control,...

CVE-2026-80907

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856...

CVE-2026-80818

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

CVE-2026-80806

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4setinodeflagsinode, init=true in ext4newinode is made before EXT4INODEENCRYPT is set. As a result, it can set...

CVE-2026-80843

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...

CVE-2026-80858

In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuseuringcreatequeue initializes a fuseringqueue and then publishes the pointer into ring-queuesqid with WRITEONCE under the fch-lock. There are several readers that may...

CVE-2026-80792

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

CVE-2026-18567

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...

CVE-2026-18567 IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...

CVE-2026-18567

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by a TOCTOU race condition (CWE-367) involving a predictable Unix domain socket path in a world-writable directory. A local attacker with low privileges could exploit this to obtain information and cause minor availability impact, rated...

EUVD-2026-71602

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...