Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

A use-after-free vulnerability exists in the netfilter component of the Linux kernel’s nftables module, which can be exploited to achieve local privilege escalation. The nftpipapowalk function does not skip inactive elements during the set walk operation, which can result in double deactivation o...

Astra Linux – Vulnerability in Linux

A flaw was discovered in the CAN BCM networking protocol within the Linux kernel. A local attacker can exploit this flaw in the CAN subsystem to corrupt memory, cause the system to crash, or escalate privileges. This race condition in the net/can/bcm.c file of the Linux kernel allows for local...

Astra Linux – Vulnerability in Linux, Linux 5.10

A vulnerability was discovered in btrfsalloctreeb in fs/btrfs/extent-tree.c within the Linux kernel, due to an improper lock operation in btrfs. This flaw allows a user with local privileges to cause a denial of service DOS due to a deadlock issue...

Astra Linux – Vulnerability in Linux

A use-after-free occurred in the function hcisockboundioctl of the Linux kernel’s HCI subsystem. This issue arises when the user calls ioct HCIUNBLOCKADDR, or when the call to hciunregisterdev triggers a race condition, along with the calls hcisockblacklistadd, hcisockblacklistdel, hcigetconninfo...

CVE-2026-90894

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

EUVD-2026-77346

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894

Parallels Desktop (macOS) contains a local privilege escalation vulnerability in the prl_disp_service daemon, which runs as root . Local clients reach it via a world-writable socket, and PrlSrv_LoginLocal accepts peer credentials with no signature or admin-group check. After login, PrlSrv_Install...

SUSE-SU-2026:4148-1 Security update for NetworkManager

This update for NetworkManager fixes the following issues: - CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. - CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation...

CVE-2026-12518 Local privilege escalation in the Logi Options+ updater service on Windows

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...

CVE-2026-12518 Local privilege escalation in the Logi Options+ updater service on Windows

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...

PT-2026-91409

Name of the Vulnerable Software and Affected Versions NetworkManager-l2tp affected versions not specified Description A flaw exists where the plugin writes attacker-controlled VPN connection properties, specifically vpn.data and vpn.secrets values, unescaped into a generated ipsec.conf file...

Amazon Linux 2023 : libvirt, libvirt-client, libvirt-client-qemu (ALAS2023-2026-2139)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2139 advisory. A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check,...

CVE-2026-12518: Improper Privilege Management

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...

CVE-2026-19624: Improper Neutralization of Argument Delimiters in a Command

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...

Linux Kernel Netlink-based Wireless Configuration Integer Overflow Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the parsing of rnr...

PT-2026-91454

Name of the Vulnerable Software and Affected Versions PackageKit affected versions not specified Description An authorization flaw exists in PackageKit when using the dnf5 backend. The system skips the polkit authorization check for transactions that include the SIMULATE dry-run flag. However, th...

PT-2026-91115

🚨 CRITICAL: Apache Storm has patched a vulnerability allowing local privilege escalation to root. CVE-2026-82430 affects the Storm Worker Launcher and can allow a local attacker to escalate privileges through container command files. ⚠️ Organizations running Apache Storm should update to a patched...

Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...