299995 matches found
CVE-2026-20275
creationtimestamp| type| source ---|---|--- 2026-09-02 16:36:40+00:00| seen| https://infosec.exchange/users/AAKL/statuses/117202419724203546 2026-09-02 21:03:08+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3muktiekvsf2j 2026-09-03 08:45:50+00:00| seen|...
DRUPAL-CONTRIB-2026-124
This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...
AZL-99372 CVE-2026-84838 affecting package rpm 4.18.2-2
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...
CVE-2026-84838
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
AZL-99390 CVE-2026-78410 affecting package util-linux for versions less than 2.40.2-6
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...
ALPINE-CVE-2026-78409
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to opentree with ATSYMLINKNOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with...
CVE-2026-78409
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to opentree with ATSYMLINKNOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with...
CVE-2026-66842
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface TMUI. Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP manageme...
CVE-2026-84838
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...
UBUNTU-CVE-2026-78410
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...
CVE-2026-66842 BIG-IP and BIG-IQ Configuration utility vulnerability
BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface TMUI. Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP manageme...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
EUVD-2026-70112
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
CVE-2026-84646
The Jenkins automation server is vulnerable in versions 2.579 and earlier (and LTS 2.568.2 and earlier ). An attacker with Overall/Read permission can exploit a flaw where user objects appear as nested field values in other deserialized XML objects. By submitting crafted XML , the attacker can cr...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
CVE-2026-78599
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...
CVE-2026-78591
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...