Remote Code Execution (RCE)

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Remote Code Execution RCE in its external module loader, lib/resolver-compat.js makeResolverFromLegacyOptions, CustomResolver.isPathAllowed, and...

Exploit for Improper Privilege Management in Mozilla Firefox

CVE-2026-74939 — Firefox content→parent privilege escalation...

CVE-2026-66906

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

tmp: path Traversal via unsanitized prefix/postfix enables directory escape

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the...

V8-sandbox-escape-PoC-

V8 Sandbox Escape PoC ⚠️ CRITICAL SECURITY WARNING ⚠️...

tmp: path Traversal via unsanitized prefix/postfix enables directory escape

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the...

[SECURITY] [DSA 6463-1] webkit2gtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6463-1 [email protected] https://www.debian.org/security/ Alberto Garcia August 24, 2026 https://www.debian.org/security/faq -...

CVE-2026-60093 Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

SUSE-SU-2026:23253-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent creation escapes the destination tree bsc1269043. -...

SUSE-SU-2026:23254-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

CVE-2026-15226

A flaw was found in Canonical snapd. An attacker with low privileges, operating within a snap application's confined environment, can exploit a vulnerability in the snap-confine component. This allows the attacker to create or modify files with set-user-ID setuid attributes, enabling them to bypa...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: landlock: Fixed the bypass of LANDLOCKSCOPESIGNAL on the SIGIO path. LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. This bypass can occur through the asynchronous SIGIO...

CVE-2026-66897

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

UBUNTU-CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

fast-uri , a URI parser for Node.js, suffers from double percent-decoding of the hostname: it decodes percent escapes during parsing and decodes them again during authority recomposition. This violates RFC 3986 §2.4 (an implementation must not decode the same string more than once) and allows a s...