EUVD-2026-40229

CryptX versions before 0.088001 for Perl compare AEAD authentication tags in non-constant time in the streaming decryptdone path. The decryptdone$tag form compares it against the computed tag with memNE memcmp != 0, which short-circuits on the first differing byte, so its run time depends on the...

CVE-2026-13758

CryptX versions before 0.088001 for Perl compare AEAD authentication tags in non-constant time in the streaming decryptdone path. The decryptdone$tag form compares it against the computed tag with memNE memcmp != 0, which short-circuits on the first differing byte, so its run time depends on the...

CVE-2026-13578

creationtimestamp| type| source ---|---|--- 2026-06-29 20:21:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphcu4semy2o...

CVE-2026-41991

A flaw was found in the gzexe utility of GNU gzip. When the mktemp utility is not available, gzexe creates temporary files with predictable names based on the process ID. A local attacker can exploit this by pre-creating a symbolic link to an arbitrary file at the predicted temporary file path...

CVE-2025-70100

creationtimestamp| type| source ---|---|--- 2026-06-29 18:33:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mph4s5nizo2y...

[SECURITY] [DLA 4657-1] sogo security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4657-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb June 29, 2026 https://wiki.debian.org/LTS -...

CVE-2026-54826

creationtimestamp| type| source ---|---|--- 2026-06-29 18:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mph3tveglw2i...

CVE-2026-13590

creationtimestamp| type| source ---|---|--- 2026-06-29 17:51:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2ilx2mu2d 2026-06-29 19:56:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphbh5w62h2x 2026-06-29 20:42:39+00:00| seen|...

CVE-2025-20272

creationtimestamp| type| source ---|---|--- 2026-06-29 17:31:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgzdmybk62o...

CVE-2026-13583

creationtimestamp| type| source ---|---|--- 2026-06-29 17:00:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgxltt3i723 2026-06-29 20:30:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphddjufj62e 2026-06-29 22:11:11+00:00| seen|...

CVE-2026-13748

creationtimestamp| type| source ---|---|--- 2026-06-29 16:57:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgxgwqtm22n 2026-06-29 16:57:19+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpgxgz7qpg2v 2026-06-29 17:53:30+00:00| seen|...

CVE-2026-56787

A flaw was found in RTKLIB. A remote attacker can exploit an off-by-one out-of-bounds read vulnerability, leading to a global buffer overflow, by sending malicious SSR correction streams over NTRIP or serial connections. This can cause a denial of service or crash affected RTKLIB rovers and CORS...

CVE-2026-54370

acl before version 2.4.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat check and subsequent symlink-following operations such as stat, chown,...

CVE-2026-40523

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SAGLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM2 and PARAM3 POST parameters. Attackers can exploit...

UBUNTU-CVE-2026-54370

acl before version 2.4.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat check and subsequent symlink-following operations such as stat, chown,...

CVE-2026-53250

A flaw was found in the Linux kernel's xsk AFXDP socket component. A malicious local userspace application can exploit a Time-of-check to time-of-use TOCTOU race condition in the xskskbmetadata function. By modifying checksum-related values in shared memory between validation and use, an attacker...

CVE-2026-9800

creationtimestamp| type| source ---|---|--- 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:48+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0815 2026-07-02 07:59:38+00:00| seen|...

CVE-2026-9086

creationtimestamp| type| source ---|---|--- 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:37+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0815 2026-07-02 05:20:05+00:00| seen|...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview acl is a None Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. in the getfacl or setfacl process. An attacker can gain unauthorized access to files or escalate privileges by exploiting a race condition where a symbolic link replaces a...

CVE-2026-54370

CVE-2026-54370 affects acl before version 2.4.0, introducing a TOCTOU race where an attacker-controlled pathname component can replace a component with a symlink between an lstat() check and subsequent operations (stat, chown, chmod, acl_get_file, acl_set_file). This enables local privilege escal...