Chromium: CVE-2026-84354 Incorrect authorization in FileSystem

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

Important: Red Hat Security Advisory: nodejs22 security update

An update for nodejs22 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9gfj-28hw-jchp. This link is maintained to preserve external references. Original Advisory knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, creat...

PT-2026-88435

Name of the Vulnerable Software and Affected Versions Okta Access Gateway affected versions not specified Description The backup restore function fails to validate the filename embedded within an encrypted backup payload. This flaw allows file contents to be written to unintended locations on the...

PT-2026-88433

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents...

PT-2026-88593

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to entice a user to...

PT-2026-88711

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to obtain cross-origin data through a crafted HTML page...

PT-2026-88647

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect reference resolution in the FileSystem component allows a remote attacker to potentially execute arbitrary code outside the sandbox. This is achieved by leveraging social...

PT-2026-88703

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to...

PT-2026-88587

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker to potentially execute arbitrary code outside the sandbox. This requires the attacker to have already...

PT-2026-88605

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted PDF file. Site isolatio...

RHEL 10 : nodejs22 (RHSA-2026:64817)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64817 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...

CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

CVE-2026-80126

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Locking vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker...

CVE-2026-80126

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Locking vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker...

CVE-2026-80126

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 contain an Improper Locking vulnerability. A low-privileged attacker with remote network access could potentially exploit this flaw to obtain filesystem access on the applianc...

EUVD-2026-72491

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Locking vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker...

CVE-2026-80126

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Locking vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-80804

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the succe...