299946 matches found
CVE-2026-19816
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...
CVE-2026-54447 garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store
garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmintokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave t...
CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...
CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...
CVE-2026-86830
Incorrect privilege assignment in Temporary Elevated Access Management TEAM for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended...
[SECURITY] [DSA 6498-1] network-manager-l2tp security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6498-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 14, 2026 https://www.debian.org/security/faq -...
CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
Incorrect privilege assignment in Temporary Elevated Access Management TEAM for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended...
CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
Incorrect privilege assignment in Temporary Elevated Access Management TEAM for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended...
EUVD-2026-77703
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes FIFOs under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a directory or FIFO already exists at that path when the agent...
CVE-2026-86836
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes FIFOs under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a directory or FIFO already exists at that path when the agent...
CVE-2026-55416
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reportsconfig permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by...
OESA-2026-3850 kata-containers-go security update
This is core component of Kata Container, to make it work, you need a isulad/docker engine. Security Fixes: A flaw was found in Kata Containers, affecting both its Rust and Go runtimes. An authenticated pod user can exploit this by setting the io.katacontainers.configpath annotation to an arbitra...
OESA-2026-3744 systemd security update
systemd is a system and service manager that runs as PID 1 and starts the rest of the system. Security Fixes: systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on...
OESA-2026-3719 containerd security update
containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...
OESA-2026-3713 NetworkManager security update
NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHC...
CVE-2026-90996
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...
DEBIAN-CVE-2026-90996
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...
CVE-2026-55235
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...
UBUNTU-CVE-2026-90996
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...
CVE-2026-90996
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...