297173 matches found
FreeBSD : FreeBSD -- TOCTOU race between sound(4) buffer resizing and mmap (1fef3562-c848-11f1-ada3-bc241121aa0a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1fef3562-c848-11f1-ada3-bc241121aa0a advisory. When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not...
HPESBNW05159 rev.1 - HPE Networking Advance Notification of Security Advisories for October 22, 2026.
Potential Security Impact: Local: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Virtual Mobility Controller Software : ----- IMPORTANT NOTE: In this advance notification, HPE Networking will not provide affected software versions. - The "Aruba...
X.Org Server Present Extension Use-After-Free Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...
X.Org Server GLX RenderLarge Heap-based Buffer Overflow Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the glXDispRenderLarge...
CVE-2026-58098: Out-of-bounds Write
When semop2 blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If...
PT-2026-114794
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A race condition exists in the kqueue fork copy knote function where it indexes into the child's file descriptor table using a knote's file descriptor number...
UBUNTU-CVE-2026-110656
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP...
CVE-2026-110150
Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local program. Chromium security severity: High...
UBUNTU-CVE-2026-92877
The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...
UBUNTU-CVE-2026-109968
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...
CVE-2026-109968
A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...
CVE-2026-95180
An issue in Justson agentweb-core versions v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components . This is caused by incorrect access control during the handling of intent:// URLs within the DefaultWebClient compone...
PT-2026-115325
Name of the Vulnerable Software and Affected Versions NoMachine affected versions not specified Description A local privilege escalation flaw exists in the NoMachine Device Service due to incorrect permissions assigned to a named pipe. A named pipe is a mechanism for inter-process communication. ...
CVE-2026-108433: Reliance on Untrusted Inputs in a Security Decision
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-111230: External Control of File Name or Path
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...
CVE-2026-95180
An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient...
CVE-2026-95180
An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient...
PT-2026-115199
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file get contents to read...
CVE-2026-101308: Time-of-check Time-of-use (TOCTOU) Race Condition
When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...
MiracleLinux 9 : flatpak-1.12.9-4.el9_8.4 (AXSA:2026-2050:04)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2050:04 advisory. flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via...