PT-2026-110579

Name of the Vulnerable Software and Affected Versions Progress ShareFile Storage Zones Controller versions prior to 5.12.7 Description Processing of queue items can send acknowledgements to an unvalidated callback URL. This behavior, combined with a race condition, allows an attacker to force the...

CVE-2026-93695: External Control of File Name or Path

In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the...

CVE-2026-93694: Server-Side Request Forgery (SSRF)

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content...

PT-2026-110578

Name of the Vulnerable Software and Affected Versions In Progress ShareFile Storage Zones Controller versions prior to 5.12.7 Description A remote unauthenticated attacker can chain improper validation of outbound request destinations and parameters, unsafe JSONP JavaScript Object Notation with...

PT-2026-110580

Name of the Vulnerable Software and Affected Versions Progress ShareFile Storage Zones Controller versions prior to 5.12.7 Description The FileCopyService uses a remote file identifier to construct a local temporary file path without enforcing containment. This flaw allows the service to write...

CVE-2026-104116 Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones

A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...

ZoneClaw: Mitigating Persistent Memory Attacks by Establishing Memory-Zoning in OpenClaw-Style Computer-Use Agents

Computer-use agents increasingly operate as long-running assistants through persistent workspace memory, which OpenClaw-style CUAs realize as automatically reloaded files that hold user instructions, system summaries, and external claims at the same privilege level. Here, remembering a claim...

SUSE CVE-2026-90187

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

Linux Distros Unpatched Vulnerability : CVE-2026-90187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off...

DEBIAN-CVE-2026-90187

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

AZL-102177 CVE-2026-90187 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

CVE-2026-90187

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

CVE-2026-90187 null_blk: free zones array on device power-off

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

CVE-2026-90185 null_blk: serialize configfs attribute stores with the lock

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

CVE-2026-90185

This Linux kernel vulnerability affects the null_blk driver's configfs attribute store path. The NULLB_DEVICE_ATTR _store handlers fail to take the device lock, so concurrent stores on separate file descriptors race . For apply_fn attributes (submit_queues, poll_queues), a losing store can overwr...

CVE-2026-90187: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

Linux Distros Unpatched Vulnerability : CVE-2026-77955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones zonemd-check: yes which are located below but not at a trust...

Astra Linux – Vulnerability in bind9

It is possible to create a zone such that certain queries to it will generate responses containing numerous records in the Additional section. An attacker sending multiple such queries can cause either the authoritative server or an independent resolver to use excessive resources to process the...

PT-2026-90542

Name of the Vulnerable Software and Affected Versions Shopper versions 2.0.0 through 2.9.1 Description Authenticated users with the access setting permission can perform unauthorized destructive actions via the Livewire endpoint. This occurs because four Livewire components in the Settings area d...

EulerOS 2.0 SP12 : dhcp (EulerOS-SA-2026-3254)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...