9123 matches found
CVE-2026-82586
Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...
CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...
CVE-2026-82586
ash_lua (ash-project) is an Elixir library that exposes Ash resources to Lua scripts, with a manifest-gated allow-list controlling which fields scripts may read. The operation aggregate path in AshLua.Runtime resolved field names via String.to_existing_atom and Ash.Query.Aggregate.new! without co...
CVE-2026-86469
A flaw was found in GLib2. When gfilereplace is used with GFILECREATEREPLACEDESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the...
EUVD-2026-72448
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is...
CVE-2026-86319 java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is...
CVE-2026-86319
A resource consumption vulnerability in the json-patch Java library (versions up to 1.13 ) affects the JsonPatch.apply function in the Patch Operation Handler component. An attacker can trigger it remotely with no authentication or user interaction, resulting in a denial-of-service condition. The...
USN-8728-1 linux-gcp-7.0 vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...
USN-8728-1: Linux kernel (GCP) vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...
PT-2026-86833
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is...
CVE-2026-86121: Missing Authentication for Critical Function
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...
CVE-2026-80848
In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcpclose frees emsg-skb via kfreeskb without holding any socket lock. Concurrently, the xfrmtransreinject wor...
CVE-2026-71979
A flaw was found in INDI indiserver. An unauthenticated remote attacker can exploit a stack buffer overflow vulnerability by sending specially crafted XML with oversized, mismatched tags. This can lead to an unbounded write operation, causing the daemon to crash and disrupting all active client a...
CVE-2026-80834: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Remove cryptorng interface Since the cryptorng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go...
The vulnerability of the “magnify” operation in the console-based image editing tool ImageMagick allows a hacker to execute arbitrary code.
The vulnerability of the “magnify” operation in the console-based image editing tool ImageMagick is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
gitpython: GitPython: Remote Code Execution via malicious Git template
A flaw was found in GitPython. An incomplete denylist in the unsafegitcloneoptions function fails to restrict the --template option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations...
OPENSUSE-SU-2026:21753-1 Security update for fuse-overlayfs
This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate operation bsc1273100...
SUSE-SU-2026:23618-1 Security update for fuse-overlayfs
This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate operation bsc1273100...
SUSE-SU-2026:23469-1 Security update for fuse-overlayfs
This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate operation bsc1273100...