ROS-20260821-73-0050

The vulnerability of the ext4mbreleasegrouppa function in the fs/ext4/mballoc.c module of the Ext4 file system in the Linux operating system is related to an uncontrolled and exploitable condition. Exploiting this vulnerability could allow a attacker to cause a service failure...

PT-2026-80200

Summary Atlantis versions = 0.19.8 and 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths. A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended...

USN-8644-2: Linux kernel (GCP) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - File systems infrastructure; - OCFS2 file system; - B.A.T.M.A.N. meshing protocol; - SCTP protocol; - TIPC protocol...

USN-8661-1 linux-azure-5.15, linux-gcp, linux-gcp-fips, linux-hwe-5.15, linux-lowlatency-hwe-5.15 vulnerabilities

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. CVE-2025-275...

CVE-2026-18482 CVE-2026-18482

Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax and runPlaywrightTest functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS...

CVE-2026-20358

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20358

Cisco Crosswork is affected by externally controlled file system issues (CWE-73), yielding a CVSS 10.0 CRITICAL score with high integrity and availability impact. No affected versions, patch details, or exploitation evidence are provided in the documents. Exploitation status is not available.

CVE-2026-20358 Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20358 Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

A vulnerability in the Open Client Interface OCI XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution...

CVE-2026-20358: External Control of File Name or Path

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-53457 Blueprint Studio terminal command working directory not bounded to config directory

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

Directory Traversal

Overview mineadmin/mineadmin is a Quickly build a background management system for web applications Affected versions of this package are vulnerable to Directory Traversal via the identifier parameter in the plugin installation and uninstallation process. An attacker can access or modify files...

USN-8644-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - File systems infrastructure; - OCFS2 file system; - B.A.T.M.A.N. meshing protocol; - SCTP protocol; - TIPC protocol...

CVE-2026-72207

A flaw was found in the NTFS file system driver in the Linux kernel. When the ntfsresidentattrresize function attempts to free space by converting resident attributes to non-resident, it incorrectly selects zero-length $DATA attributes for this conversion. This can lead to fsck file system check...

CVE-2026-72164

A flaw was found in the ocfs2 component of the Linux kernel. A local user can exploit a vulnerability in the ocfs2moveextent function when performing OCFS2IOCMOVEEXT operations. This issue allows file data to be copied into a disk cluster that is already occupied by another file, leading to data...

GO-2026-6110 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal in github.com/OpenListTeam/OpenList

OpenList: Authenticated users can rename files outside their base path via batch rename srcname traversal in github.com/OpenListTeam/OpenList...

CVE-2026-72377

A flaw was found in the Linux kernel's Andrew File System AFS module. When fscache is enabled, AFS symlinks and mountpoints are incorrectly handled during memory management operations. This can lead to a pointer dereference, which a local attacker could potentially exploit to cause a system crash...

CVE-2026-72160

A flaw was found in ocfs2 Oracle Cluster File System version 2 in the Linux kernel. This vulnerability arises from insufficient validation of on-disk inode metadata, specifically the imode type bits. A local attacker could exploit this by crafting a malformed disk inode with a non-canonical POSIX...

CVE-2026-19589

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...