CentOS Linux 8.5 [TuxCare] Security Update: sudo / sudo-devel (CENTOS8.5:CLSA-2026:1777940187)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1777940187 advisory. - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the maile...

CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS7:CLSA-2026:1777941033)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777941033 advisory. - In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the...

AlmaLinux 9.2 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc (ALMALINUX9.2:CLSA-2026:1777479123)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777479123 advisory. - In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the...

CentOS Linux 8 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS-STREAM8:CLSA-2026:1777546896)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777546896 advisory. - In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if...

CentOS Linux 6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-ldap / etc (CENTOS6:CLSA-2026:1777942153)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777942153 advisory. - In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the...

AlmaLinux 9.6 [TuxCare] Security Update: sudo / sudo-devel / sudo-python-plugin (ALMALINUX9.6:CLSA-2026:1778073563)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778073563 advisory. - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the maile...

CentOS Linux 8 [TuxCare] Security Update: sudo / sudo-devel (CENTOS-STREAM8:CLSA-2026:1778002733)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1778002733 advisory. - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the...

Rocky Linux 9.6 [TuxCare] Security Update: sudo / sudo-devel / sudo-python-plugin (ALMALINUX9.6:CLSA-2026:1778073563)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778073563 advisory. - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the...

SUSE CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-100310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege check...

UBUNTU-CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310 GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-100310

The GNU libextractor library (versions

PT-2026-99099

Name of the Vulnerable Software and Affected Versions GNU libextractor versions prior to 1.16 Description The software loads plugins from an untrusted search path defined by the LIBEXTRACTOR PREFIX environment variable without performing proper privilege checks. A local attacker can manipulate th...

PT-2026-99022

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid...

CVE-2026-93658

A flaw was found in uutils coreutils. When installing files, the software applies setuid or setgid permissions before finalizing ownership changes. This can allow a privileged user to inadvertently leave behind executable files with elevated privileges if the ownership change operation fails on...

In OpenSSH before 10.3, a file downloaded by scp -0 as root can lead to privileged escalation

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O legacy scp protocol and without -p preserve mode...

CVE-2026-93658

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...

CVE-2026-93658

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...