CVE-2026-97026 Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

CVE-2026-97025 Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-97025 Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-97025

The Flatpak application is vulnerable to a local information disclosure flaw where it writes the OCI repository authentication token with world-readable permissions (0644 ) in the system-helper's cache directory. This allows other local users on a multi-user system to read the token and impersona...

CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-97534

A flaw was found in the Linux kernel's Flash-Friendly File System F2FS. When segment ranges are truncated, the file system fails to properly adjust the free section counter for sections that were already marked free, leading to an overestimation of available storage during background garbage...

CVE-2026-97532

A flaw was found in the Linux kernel's qla2xxx storage driver. When memory allocation fails during device initialization, the driver's error-handling routine fails to clear pointers to memory that has already been released. A local user capable of triggering device initialization failures can cau...

CVE-2026-102006

Wind River VxWorks 7 prior to version 26.09 is vulnerable to a memory management flaw where specific system call arguments cause the process management subsystem to fail to release allocated kernel memory before an application terminates. This can lead to a high availability impact as kernel memo...

CVE-2026-102006 VxWorks 7 Memory allocation

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09...

EUVD-2026-88548

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09...

CVE-2026-102004

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09...

CVE-2026-102005

Wind River VxWorks 7 versions 24.03 through 26.03 are susceptible to a memory leak vulnerability. This issue occurs when processing specific service routines under certain non-default configuration states, which prevents the system from releasing allocated memory pools before terminating operatio...

CVE-2026-98010

A flaw was found in the Linux kernel's Deficit Round Robin DRR network packet scheduler. This vulnerability allows a local user with network administration privileges to cause a Denial of Service DoS by configuring a traffic class with an unconstrained low quantum value. When processed with large...

CVE-2026-98011

A flaw was found in the Linux kernel's Heavy-Hitter Filter HHF network scheduler. A local attacker with network administration privileges, which can be acquired within an unprivileged user namespace, can cause a Denial of Service DoS. By setting an excessively small quantum value alongside a...

CVE-2026-97531

A flaw was found in the Linux kernel's qla2xxx Fibre Channel driver. This issue may allow a local privileged user or storage fabric event to cause a Denial of Service DoS through a system crash. A race condition occurs when a virtual port is deleted concurrently with a port identification request...

CVE-2026-102004 VxWorks 7

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09...

EUVD-2026-88467

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09...

CVE-2026-102004 VxWorks 7

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09...

CVE-2026-102004

Wind River VxWorks 7 versions prior to 26.09 are vulnerable to a memory corruption flaw within the memory management subsystem . The vulnerability is triggered by providing specific arguments to certain system calls . This issue can lead to high impacts on confidentiality, integrity, and availabi...

CVE-2026-101105

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...