SUSE CVE-2026-80757

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...

CVE-2026-80757

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common securitygetpermissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread takes that nprim verbatim...

DEBIAN-CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

ALPINE-CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

SUSE CVE-2026-82253

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

CVE-2026-84795 Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...

CVE-2026-84795 Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...

CVE-2026-84795 Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...

CVE-2026-84795: Improper Privilege Management

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...

Linux Distros Unpatched Vulnerability : CVE-2026-82253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only...

GHSA-44V6-7FXQ-VGF4 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Summary The fix for CVE-2026-35595 project re-parenting privilege escalation only gates reparent operations when parentprojectid 0. A user with Write but not Admin permission on a shared child project can detach it from its parent by sending parentprojectid: 0, bypassing the Admin requirement. Th...

Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Summary The fix for CVE-2026-35595 project re-parenting privilege escalation only gates reparent operations when parentprojectid 0. A user with Write but not Admin permission on a shared child project can detach it from its parent by sending parentprojectid: 0, bypassing the Admin requirement. Th...

CVE-2026-55064 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

CVE-2026-55064

Vikunja (open-source self-hosted task management platform) versions 2.3.0 through 2.4.0 contain an incomplete fix for CVE-2026-35595. The authorization checks in pkg/models/project_permissions.go and pkg/models/project.go only gate reparent operations when parent_project_id > 0, but UpdateProj...

CVE-2026-55064

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

DEBIAN-CVE-2026-82253

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

AZL-98409 CVE-2026-82253 affecting package rust for versions less than 1.75.0-30

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

CVE-2026-82253

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

AZL-98433 CVE-2026-82253 affecting package rust for versions less than 1.96.1-2

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

UBUNTU-CVE-2026-82253

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...