Linux Distros Unpatched Vulnerability : CVE-2026-85985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugi...

CVE-2026-85985: Missing Authorization

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

Red Hat: CVE-2026-85985: mariadb: MariaDB: Unauthorized file access via CONNECT engine functions

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-102631

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

EUVD-2026-102198

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

CVE-2026-102631

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

Astra Linux – Vulnerability in Firefox

The sourceMapURL feature in devtools lacked security checks, which would have prevented a webpage from attempting to include local files or other files that should be inaccessible. This vulnerability affects Firefox versions earlier than 99...

CVE-2020-11651

CVE-2020-11651 PoC for CVE-2020-11651 Requires Python3 tested on 3.8 python3.8 -m pip install pyzmq msgpack ⇒ python3.8 poc.py -h usage: poc.py -h -p PORT -c CMD -k -m -r READ -w WRITE -f FILE server server ... Exploit CVE-2020-11651 positional arguments: server Target Server IP or Host optional...

PYSEC-2026-4242 LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llamaindex version v0.12.19. This vulnerability allows an attacker to manipulate the refdocid parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code...

CVE-2026-55498 FileRise Shared Folder Symlink Escape

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An...

CVE-2026-85714

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

CVE-2026-85714

The Stirling-PDF web application is vulnerable to Remote Code Execution (RCE) in versions prior to 2.13.2 . An authenticated administrator using the default H2 database can upload a crafted SQL file via the POST /api/v1/database/import-database endpoint. The DatabaseService.validateSqlContent() m...

CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: flatpak (UTSA-2026-130041)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130041 advisory. In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code executi...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130127)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130127 advisory. rsync before 3.5.0contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and...

CVE-2026-53562

Improper link resolution before file access 'link following' vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2...

CVE-2026-55183

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

CVE-2026-55183

Prior to version 0.2.7 , RClone Manager (a cross-platform GUI for managing Rclone remotes) is vulnerable to an unauthenticated remote attack. The application launches the local rclone rcd service on 127.0.0.1:51900 using --rc-no-auth, --rc-allow-origin *, and --rc-serve. This configuration allows...

CVE-2026-55183 RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...