300372 matches found
CVE-2026-79619 OpenZFS: user-namespace capability check allows unprivileged local authorization bypass
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrativ...
CVE-2026-79619
CVE-2026-79619 affects OpenZFS on Linux, where several ioctl authorization checks incorrectly treat a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege. This allows an unprivileged local user to perform root-requiring operations such as pool c...
CVE-2026-80203
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...
MSC-2026-11493
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-11491
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-11486
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-11484
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
CVE-2026-80203 Grav before 1.0.18 Authentication Bypass via Scoped API Key
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...
CVE-2026-80203
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...
CVE-2026-80203
The getgrav/grav-plugin-api plugin before 1.0.18 contains an authentication bypass in the requireNotSuperTarget() function within UsersControllers.php, affecting seven sensitive user-management endpoints. The root cause is that the scope check calls isSuperAdmin() on the acting account rather tha...
CVE-2026-80203 Grav before 1.0.18 Authentication Bypass via Scoped API Key
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...
CVE-2026-19042
A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...
CVE-2026-80346 StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...
CVE-2026-80346 StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...
MSC-2026-11482
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
CVE-2026-19042 Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling
A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...
CVE-2026-19042 Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling
A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...
polkit: Polkit: Denial of Service via unbounded input processing through standard input
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the polkit-agent-helper-1 setuid binary via standard input stdin. This unbounded input can lead to an out-of-memory OOM condition, resulting in a Denial of Service DoS for the...
CVE-2026-14662
A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...
CVE-2026-78237
Admin By Request (ABR) for macOS is affected by an insufficient input validation flaw (CVE-2026-78237, CVSS 7.8 HIGH ). A low-privileged local user can inject malicious entries into the sudoers file during an ABR session, granting persistent root access that remains effective even after the eleva...