230634 matches found
PT-2026-64274
Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...
PT-2026-64311
Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description The variables feature stores sensitive information in cleartext on the disk when no vault is selected. This allows a local actor with file system access to read secret...
CVE-2026-43499: A Critical Analysis of the "Zero-Self" Fallacy
This document presents a comprehensive technical analysis refuting the claim that CVE-2026-43499 GhostLock constitutes "no real vulnerability" due to its requirement for local access and user interaction. Through rigorous examination of the attack surface, exploitation vectors, and real-world...
Security update for avahi (moderate)
openSUSE security update: security update for avahi ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21417-1 Rating: moderate References: bsc1255451 Cross-References: CVE-2025-59529 CVSS scores: CVE-2025-59529 SUSE : 5.5...
CVE-2026-38764
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys...
CVE-2026-63313 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch
9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...
CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...
CVE-2026-65010
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...
CVE-2026-47178
A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A local attacker could exploit this vulnerability by convincing a user to open a specially crafted HEIF file. This crafted file triggers a heap out-of-bounds write, which can lead to arbitrary code execution. This could...
CVE-2026-65010 Datasets Symlink-following Arbitrary File Write via Extractor.extract()
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...
CVE-2026-65010
The CVE-2026-65010 entry covers a symlink-following vulnerability in Datasets (versions up to 5.00) within Extractor.extract(), where pre-placed symlinks at predictable output paths allow a local attacker to write arbitrary files in shared-cache environments. This could enable overwriting sensiti...
EUVD-2026-48361
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...
CVE-2026-65010 Datasets Symlink-following Arbitrary File Write via Extractor.extract()
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...
Updated cifs-utils packages fix a security vulnerability
The updated packages fix a security vulnerability: Local privilege escalation via forged cifs.spnego key description in cifs.upcall. CVE-2026-12505...
Security update for avahi
This update for avahi fixes the following issue: CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...
Security update for avahi
This update for avahi fixes the following issue: CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...
SUSE-SU-2026:3217-1 Security update for avahi
This update for avahi fixes the following issue: - CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451...
USN-8602-1: libinput vulnerability
It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to inject arbitrary udev properties and execute arbitrary code as root...
kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing
A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio subsystem. An inconsistency in how USB audio playback and capture streams are handled can lead to an out-of-bounds write to a memory buffer. This can result in a system crash, causing a denial of service for a...