Linux Distros Unpatched Vulnerability : CVE-2026-89601

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext2: Fix lost inode updates for ISSYNC inodes ext2setsize and ext2xattrset2 had a construct like: if ISSYNCinode syncinodemetadatainode, 1 %NASLMINLEVEL 80900...

CVE-2026-80807

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

CVE-2026-80644

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

F2FS Heap Buffer Overflow DoS

The vulnerability of the doread inode function in the fs/f2fs/inode.c module of the F2FS file system in the Linux operating system is related to a logical error in the operator precedence. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-54093

CVE-2026-54093 affects File Browser prior to v2.63.6, where archive entry names for zip/tar are built using Windows-style backslashes. On Linux, backslashes are preserved in names, allowing a Windows-style traversal like ....\evil.txt to be written on disk and then emitted verbatim in the archive...

CVE-2026-54093 File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, filebrowser builds the download-as-zip / download-as-tar archive entry names with filepath.ToSlash, which on a Linux host is a no-op for...

GHSA-GXJX-7M74-HCQ8 File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

Summary filebrowser builds the download-as-zip / download-as-tar archive entry names with filepath.ToSlash, which on a Linux host is a no-op for backslashes \ is only a path separator on Windows. A file whose name contains Windows-style traversal ......\evil.txt is accepted by the resource...

PT-2026-49066

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.6 Description An issue exists where the software fails to properly normalize file paths when creating zip or tar archives on Linux hosts. Specifically, the getFiles function uses filepath.ToSlash, which does...

CVE-2026-45864

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent infinite loops caused by the next valid being the same When processing valid within the range valid : pos, if valid cannot be retrieved correctly, for example, if the retrieved valid value is always the same, th...

curl: curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write

Summary: The curl CLI's --skip-existing option performs a separate existence check before the download body is written. In the verified path, curl first calls stat on the target pathname and decides "the file does not exist, so continue", but it does not keep an fd bound to that decision. The...

ext4_rename Heap Buffer Overflow DoS

The vulnerability of the ext4rename function in the fs/ext4/namei.c file of the Ext4 file system in the Linux operating system is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow a attacker to cause service failures...

Linux fs/ext4/namei.c Heap Buffer Overflow DoS

The vulnerability of the dxprobe function in the fs/ext4/namei.c module of the Linux file system support module is related to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability could allow a hacker to cause service failures...

Linux fs/hfs/bnode.c DoS

The vulnerability of the fs/hfs/bnode.c component in the Linux operating system is related to reading data from beyond the allowed buffer size. Exploiting this vulnerability allows an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2025-40025

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix to do sanity check on node footer for non inode dnode As syzbot reported below: ------------ cut here ------------ kernel BUG at fs/f2fs/file.c:1243!...

EUVD-2003-0495

Malware in sbrugna...

EUVD-2017-18743

Malware in sbrugna...

CVE-2025-38697

The CVE relates to the Linux kernel JFS: an upper bound check in dbAllocAG when computing the tree index could go out of bounds if filesystem metadata is corrupted. This could enable a local attacker to trigger out-of-bounds conditions in JFS data structures. The vulnerability is resolved in the ...

Linux Distros Unpatched Vulnerability : CVE-2025-37785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext4: fix OOB read when checking dotdot dir Mounting a corrupted filesystem with directory which contains '.' dir entry with reclen == block size results in...

Linux Distros Unpatched Vulnerability : CVE-2025-37931

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in...

kernel: ext4: avoid journaling sb update on error if journal is destroying

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid journaling sb update on error if journal is destroying Presently we always BUGON if trying to start a transaction on a journal marked with JBD2UNMOUNT, since this should never happen. However, while ltp running stress...