Important: docker

Issue Overview: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. CVE-2026-171...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2026-124)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-124 advisory. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the...

Important: docker

Issue Overview: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. CVE-2026-171...

Amazon Linux 2 : docker (ALASDOCKER-2026-152)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-152 advisory. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer...

Rocky Linux 10.2 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_88262)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688262 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Gitea 1.27.0 Arbitrary File Read

Gitea version 1.27.0 and prior affected versions contain an arbitrary file read through Org-mode +INCLUDE directives submitted to a public repository markup endpoint. The proof of concept retrieves target files and attempts a chain to command execution. https://packetstorm.news/download/237363...

CVE-2026-112907

On Windows the soft locks "SoftFileLock", "MarkerSoftFileLock", "SoftFileLease", their async forms, and a "FileLock" that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each "acquire" attempt that finds a marker opens ...

CVE-2026-112913

On Windows, "ReadWriteLock" and "AsyncReadWriteLock" the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: "-journal", the rollback journal pages saved to undo an interrupted write; "-wal", the...

SUSE CVE-2026-98975

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes every mapping moved and hands the reflink flag over to the other file...

SUSE CVE-2026-99052

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVELABELS on already-initialized sb in setmntopts When an NFSv4 filesystem exported with securitylabel is mounted a second time, sgetfc returns the existing superblock and nfsgetroot calls securitysbsetmntopt...

Exploit for Path Traversal in Fortinet Fortimail

fortimail-cve-2026-104286-check Standalo...

Exploit for CVE-2026-21589

atlassian-cve-2026-21589-check Standalo...

Exploit for Authentication Bypass by Spoofing in Beyondtrust Remote_Support

beyondtrust-remote-support-cve-2026-102764-check...

SUSE CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CLSA-2026-1786360814 avahi: Fix of 3 CVEs

CVE-2025-59529: limit local simple-protocol clients to prevent memory and file descriptor exhaustion...

CVE-2026-115931

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads...

Exploit for CVE-2026-54668

CVE-2026-54668 — PoC: XXE in Kitodo.Production XMLUtils Р...

CLSA-2026-1792794952 python3.9: Fix of CVE-2026-12345

CVE-2026-12345: fix symlink race in tempfile.TemporaryDirectory cleanup that could delete or chmod files outside the temporary directory...

EUVD-2026-105028

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock- link directory name...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via SQLite side-file handling in readwrite.py on Windows, where a local attacker can plant adversarial -wal or -journal side files adjacent to the lock database in a shared directory such ...