CVE-2026-33263

When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...

CVE-2026-33263

When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...

CVE-2026-33263

When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...

PT-2026-83051

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description A crash can occur in the submission-login process when the mail max userip connections limit is reached, resulting in an epoll panic due to file descriptor handling issues. In high-security mode,...

PT-2026-83356

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0 Description When using the disk storage engine for handling multipart/form-data, the software fails to close the underlying write file descriptor if an upload is aborted or truncated before the write stream...

UBUNTU-CVE-2026-33263

When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...

CVE-2026-77037: Uncontrolled Resource Consumption

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...

CVE-2026-33263: Exposure of File Descriptor to Unintended Control Sphere

When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtirpc (UTSA-2025-002260)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002260 advisory. In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This ca...

Wasmtime has a leak in WASIp1 `fd_renumber` implementation

Impact Wasmtime's native implementation of WASIp1 suffers from a leak in the fdrenumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of...

GHSA-3P27-QVP9-27QF Wasmtime has a leak in WASIp1 `fd_renumber` implementation

Impact Wasmtime's native implementation of WASIp1 suffers from a leak in the fdrenumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of...

CVE-2026-73102

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

CVE-2026-73102 RustDesk Path Traversal via macOS Clipboard File-Paste

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

CVE-2026-73102 RustDesk Path Traversal via macOS Clipboard File-Paste

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

PT-2026-82092

Name of the Vulnerable Software and Affected Versions RustDesk versions 1.3.9 through 1.4.9 Description A path traversal issue exists in the macOS clipboard file-paste code path. The application accepts file descriptor names provided by a peer and joins them to the target directory without...

Intel Data Accelerator DMA Driver Heap Buffer Overflow DoS

The vulnerability in the llistabortdesc function within the drivers/dma/idxd/submit.c file of the Intel Data Accelerator DMA driver for Linux operating systems is related to the use of invalid file descriptors. Exploitation of this vulnerability may allow a remote attacker to compromise the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed a race condition between direct IO writes and fsync operations when using the same file descriptor. If we have two threads that use the same file descriptor, and one of them performs direct IO writes while the other...

PT-2026-85364

This update for libarchive fixes the following issues: - Fix creation of temporary files in target directory bsc1254340 - Fix out-of-bounds buffer overrun when using pH LEVEL OFFSET bsc1254341 - Fix buffer overrun in archive le32dec when reading truncated 7zip headers bsc1254342 - Fix NULL pointe...

PT-2026-85367

This update for libarchive fixes the following issues: - Fix creation of temporary files in target directory bsc1254340 - Fix out-of-bounds buffer overrun when using pH LEVEL OFFSET bsc1254341 - Fix buffer overrun in archive le32dec when reading truncated 7zip headers bsc1254342 - Fix NULL pointe...

JLSEC-2026-1367

Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 which suffers from a leak in the fdrenumber function where the...