CVE-2026-21986-VirtualBox-DoS

CVE-2026-21986 - VirtualBox 共有フォルダのカーネルメモリ枯渇（DoS） 概要 このリポジトリには、Oracle VM VirtualBox のサービス拒否（DoS）脆弱性である CVE-2026-21986 の概念実証（PoC）と技術解説書が含まれています。 この問題は Shared Folders ドライバインターフェースに存在し、デバイスの IOCTL インターフェースを通じてカーネルメモリの割り当てを繰り返しトリガーできるようになっています。これにより、非ページ カーネルメモリが枯渇し、仮想マシンがフリーズする可能性があります。 本脆弱性には...

CVE-2026-59815 Joplin: Pending share recipients can write items into shared folders before accepting invitations

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

CVE-2026-59815

Joplin Server (an open-source note-taking and to-do application) had an authorization flaw in ItemModel.checkIfAllowed() prior to version 3.7.7 . The method granted write access to items with a share ID whenever any share_users row existed for the caller, without requiring ShareUserStatus.Accepte...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the DELETE /api/v1/folders/id process. An attacker can permanently delete another user's chat history and subfolders by exploiting inherited write permissions on shared...

CVE-2026-61505

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact...

CVE-2026-61505

Vulnerability summary: Rejetto HFS versions 3.0.0–3.2.0 are affected by a path traversal via the lang parameter, allowing a remote, unauthenticated attacker to read certain JSON files outside shared folders. The impact is constrained to files matching a narrow naming/format pattern, with no indic...

CVE-2026-61505 Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact...

CVE-2026-61505

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact...

Security update for dovecot22

This update for dovecot22 fixes the following issues CVE-2026-33603: login: base64 input can contain tabs that bypass IPC protection bsc1265147. CVE-2026-40020: IMAP folders can be shared-spammed to everyone bsc1265149. CVE-2026-42006: imap-login: uncontrolled memory usage with excessive bracing...

CVE-2026-56768 Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method

Seahub before 13.0.23 does not enforce SHARELINKLOGINREQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory...

EUVD-2026-39520

Seahub before 13.0.23 does not enforce SHARELINKLOGINREQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory...

Linux Distros Unpatched Vulnerability : CVE-2026-35275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Shared Folders. The supported version that is affected is 7.2.8. Difficult...

Oracle VM VirtualBox (June 2026 CSPU)

The 7.2.8 versions of VM VirtualBox installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.8...

EUVD-2026-37405

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Shared Folders. The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...

CVE-2026-35275

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Shared Folders. The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...

CVE-2026-35275

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Shared Folders. The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...

Vulnerabilities in Oracle VM VirtualBox

Oracle has identified several vulnerabilities in Oracle VM VirtualBox version 7.2.8. These vulnerabilities are located in various components of Oracle VM VirtualBox 7.2.8, including the Shared Folders and the VMSVGA device. An attacker with low to high privileges and access to the underlying...

CVE-2026-35275

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Shared Folders. The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...

PT-2026-49850

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.8 Description An issue exists in the Shared Folders component of Oracle VM VirtualBox. A low-privileged attacker with logon access to the infrastructure where the software executes can compromise the system...

ROS-20251201-01

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to insufficient protection of service data. Exploitation of the vulnerability could allow an attacker to gain unauthorized access to protected information Vulnerability of Core component of...