3405 matches found
CVE-2026-35346
The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::fromutf8lossy, which replaces invalid UTF-8 byte sequences with the Unicode replacement character U+FFFD. This behavior differs from GNU comm, whic...
CVE-2026-35364
A Time-of-Check to Time-of-Use TOCTOU race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit thi...
CVE-2026-35359
A Time-of-Check to Time-of-Use TOCTOU vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the ONOFOLLOW flag. An attacker with...
CVE-2026-35354
A Time-of-Check to Time-of-Use TOCTOU vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute xattr preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with writ...
CVE-2026-35346
The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::fromutf8lossy, which replaces invalid UTF-8 byte sequences with the Unicode replacement character U+FFFD. This behavior differs from GNU comm, whic...
CVE-2026-35345
A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the...
openjdk: Improve Kerberos credentialing (Oracle CPU 2026-04)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 a...
CVE-2026-31470
In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length Validate host controlled value quotebuf-outlen that determines how many bytes of the quote are copied out to guest userspace. In TDX environments with remote...
CVE-2026-31478
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2len with offsetof in smb2calcmaxoutbuflen After this commit e2b76ab8b5c9 "ksmbd: add support for read compound", response buffer management was changed to use dynamic iov array. In the new design,...
CVE-2026-6861
A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG Scalable Vector Graphics CSS Cascading Style Sheets data. A local user could exploit this by convincing a victim to open a malicious SVG file, which may lead to a denial...
CVE-2026-22020
updated libpng in Oracle Java...
GHSA-Q49F-XG75-M9XW vulnerabilities
Vulnerabilities for packages: wizer, wasmcloud, zed, yara-x...
GHSA-JJ8C-MMJ3-MMGV vulnerabilities
Vulnerabilities for packages: airflow, open-webui, datahub-ingestion-fips, mlflow, datahub-ingestion, pgadmin4-fips...
CVE-2026-34308
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: JSON. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...
GHSA-5592-P365-24XH vulnerabilities
Vulnerabilities for packages: imagemagick...
CVE-2026-34990 affecting package cups for versions less than 2.4.17-1
CVE-2026-34990 affecting package cups for versions less than 2.4.17-1. An upgraded version of the package is available that resolves this issue...
GHSA-C3FC-8QFF-9HWX vulnerabilities
Vulnerabilities for packages: logstash-fips, ruby3.4-bouncy-castle-java, nacos-docker, logstash, camunda, geoserver, ruby4.0-bouncy-castle-java, ruby3.3-bouncy-castle-java, ghidra, hono, kayenta-fips, gradle, apache-nifi-registry, commercial-elasticsearch, thingsboard, wildfly, apache-nifi,...
CVE-2026-1839 vulnerabilities
Vulnerabilities for packages: py3-transformers, vllm-openai-cuda-12.9, text-generation-inference, tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, lmcache-cuda-12.8, nemo...
