Astra Linux – Vulnerability in Linux, Linux 5.10

A vulnerability was discovered in btrfsalloctreeb in fs/btrfs/extent-tree.c within the Linux kernel, due to an improper lock operation in btrfs. This flaw allows a user with local privileges to cause a denial of service DOS due to a deadlock issue...

Astra Linux – Vulnerability in Linux, Linux 5.10

A memory flaw after deallocation was discovered in the Linux kernel’s garbage collection for Unix domain socket file handlers. This flaw occurs when users call close and fget simultaneously, potentially triggering a race condition. This flaw allows a local user to crash the system or escalate the...

CVE-2026-90894

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

EUVD-2026-77346

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894

Parallels Desktop (macOS) contains a local privilege escalation vulnerability in the prl_disp_service daemon, which runs as root . Local clients reach it via a world-writable socket, and PrlSrv_LoginLocal accepts peer credentials with no signature or admin-group check. After login, PrlSrv_Install...

SUSE-SU-2026:4148-1 Security update for NetworkManager

This update for NetworkManager fixes the following issues: - CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. - CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation...

CVE-2026-12518 Local privilege escalation in the Logi Options+ updater service on Windows

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...

CVE-2026-12518 Local privilege escalation in the Logi Options+ updater service on Windows

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...

PT-2026-91841

It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to inject arbitrary udev properties and execute arbitrary code as root...

PT-2026-91409

Name of the Vulnerable Software and Affected Versions NetworkManager-l2tp affected versions not specified Description A flaw exists where the plugin writes attacker-controlled VPN connection properties, specifically vpn.data and vpn.secrets values, unescaped into a generated ipsec.conf file...

Linux Kernel IPv6 VTI Subsystem Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of...

CVE-2026-19624: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...

Linux Kernel Netlink-based Wireless Configuration Integer Overflow Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the parsing of rnr...

PT-2026-91454

Name of the Vulnerable Software and Affected Versions PackageKit affected versions not specified Description An authorization flaw exists in PackageKit when using the dnf5 backend. The system skips the polkit authorization check for transactions that include the SIMULATE dry-run flag. However, th...

PT-2026-91115

🚨 CRITICAL: Apache Storm has patched a vulnerability allowing local privilege escalation to root. CVE-2026-82430 affects the Storm Worker Launcher and can allow a local attacker to escalate privileges through container command files. ⚠️ Organizations running Apache Storm should update to a patched...

CVE-2026-12518: Improper Privilege Management

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...

PT-2026-91137

Name of the Vulnerable Software and Affected Versions Parallels Desktop versions prior to 27.0.0 Description A local privilege escalation issue exists in Parallels Desktop for Mac where an unprivileged local user can execute code as root. The prl disp service daemon runs with root privileges and...

Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...