4748 matches found
Oracle Linux 9 : ELSA-2026-66180-0: / kernel (ELSA-2026-661800)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-661800 advisory. - tcp: call skdataready after listener migration Felix Maurer RHEL-232236 CVE-2026-46015 - flowdissector: do not dissect PPPoE PFC frames Felix Maure...
Time-of-Check Time-of-Use (TOCTOU)
Apache CXF is vulnerable to Time-of-Check Time-of-Use TOCTOU. The vulnerability is due to a race condition in JCacheCodeDataProvider that allows the same authorization code to be redeemed concurrently, which allows an attacker to obtain multiple distinct and valid access tokens from a single...
CVE-2026-68488
A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...
EUVD-2026-75594
A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...
CVE-2026-68488
A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...
CVE-2026-68488
A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...
CVE-2026-68488
CVE-2026-68488 is a TOCTOU race condition in Plesk's Backup Manager that leads to insecure symlink following during restore operations. An attacker with low privileges can exploit this to take over ownership of arbitrary files or directories, resulting in local privilege escalation to root . The ...
Linux Kernel Security Vulnerabilities
The Linux kernel has a security vulnerability. This vulnerability arises from NFSD checking the truncation permissions based on the size of unlocked files before acquiring the inode lock. The actual truncation operation is performed by notifychange after the lock is obtained. There is a TOCTOU ra...
DEBIAN-CVE-2026-88924
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2026-88924
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2026-88924
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the gvfsd-admin daemon of gvfs (GNOME Virtual Filesystem). The privileged daemon calls the link-following chown() on a socket pathname inside a user-controlled directory; a local attacker can replace that pathname with a symbolic link ...
CVE-2026-88924 Gvfs: gvfs-admin socket ownership race permits local root
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2026-88924
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2026-88924 Gvfs: gvfs-admin socket ownership race permits local root
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
EUVD-2026-75537
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2026-88924 Gvfs: gvfs-admin socket ownership race permits local root
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2026-88924
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
PYSEC-2026-3895 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
Summary praisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhook URLs by resolving the hostname and checking whether the IP is private. When DNS resolution fails socket.gaierror, the validator silently passes the URL via except socket.gaierror: pass. Additionally, even when...
PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
Summarypraisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhookURLs by resolving the hostname and checking whether the IP is private. When DNSresolution fails socket.gaierror, the validator silently passes the URL viaexcept socket.gaierror: pass. Additionally, even when DNS...