PT-2026-34267

Name of the Vulnerable Software and Affected Versions nano affected versions not specified Description A flaw exists where incorrect directory permissions are applied to the /.local directory, setting them to 0777 instead of 0700 in environments with permissive umask settings. A local attacker ca...

Lawnchair 安全漏洞

Lawnchair is an open-source Android desktop launcher developed by Lawnchair, featuring highly customizable features and Pixel functionality. Lawnchair has a security vulnerability, which stems from command injection in the releaseupdate.yml workflow scheduling input, potentially allowing arbitrar...

heroic-games-launcher-2.20.1-5.1 on GA media (moderate)

heroic-games-launcher-2.20.1-5.1 on GA media Announcement ID: openSUSE-SU-2026:10497-1 Rating: moderate Cross-References: CVE-2026-34601 CVSS scores: CVE-2026-34601 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2026-34601 SUSE : 8.7...

CVE-2026-35020

Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the command lookup helper and deep-link terminal launcher that allows local attackers to execute arbitrary commands by manipulating the TERMINAL environment variable. Attackers can inject shell...

Improper Link Resolution

kubevirt.io/kubevirt is vulnerable to improper link resolution. The vulnerability is due to lack of verification of whether the launcher-sock is a symlink or regular file, which allows an attacker with control over the virt-launcher pod file system to manipulate file ownership on the host and...

Improper Symlink Handling

kubevirt.io/kubevirt is vulnerable to improper symlink handling. The vulnerability is due to improper validation of symbolic links in PVC disk mounting along with incorrect file ownership changes, which allows an attacker with control over PVC contents to create malicious symlinks and read...

OPENSUSE-SU-2026:10497-1 heroic-games-launcher-2.20.1-5.1 on GA media

These are all security issues fixed in the heroic-games-launcher-2.20.1-5.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-34388

Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all...

CVE-2026-35020

CVE-2026-35020 entry is rejected/not used by the CNA.

CVE-2026-35020

...

CVE-2024-14032 Twitch Studio LauncherHelper XPC Missing Authorization to Root File Write

Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite...

GO-2026-4915 Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet...

PT-2026-29955

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet...

heroic-games-launcher-2.20.1-4.1 on GA media (moderate)

heroic-games-launcher-2.20.1-4.1 on GA media Announcement ID: openSUSE-SU-2026:10462-1 Rating: moderate Cross-References: CVE-2026-33036 CVSS scores: CVE-2026-33036 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-33036 SUSE : 8.7...

Dassault Systèmes 3DEXPERIENCE Station Launcher App 安全漏洞

Dassault Systèmes 3DEXPERIENCE Station Launcher App is a native program installation tool developed by Dassault Systèmes, a French company. The Dassault Systèmes 3DEXPERIENCE Station Launcher App versions from R2023x to R2025x contain security vulnerabilities. These vulnerabilities stem from a...

EUVD-2026-16795

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint...

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

Summary A Denial of Service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers. Impact ...

GHSA-W254-4HP5-7CVV Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

Summary A Denial of Service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers. Impact ...

OPENSUSE-SU-2026:10462-1 heroic-games-launcher-2.20.1-4.1 on GA media

These are all security issues fixed in the heroic-games-launcher-2.20.1-4.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-34388

Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all...