574082 matches found
SUSE CVE-2026-80643
In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Fix call trace due to missing release When unloading the igen6edac driver, there is a call trace: Device 'null' does not have a release function, it is broken and must be fixed. See Documentation/core-api/kobject.rst...
SUSE CVE-2026-80656
In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...
SUSE CVE-2026-80679
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasdreleasespace checks the implementation of the isese discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND...
SUSE CVE-2026-80688
In the Linux kernel, the following vulnerability has been resolved: riscv: drop init from veccheckunalignedaccessspeedallcpus This function runs within a kthread and need not necessarily finish before system finishes boot and freeinitmem unmaps the .init.text section. This function makes calls to...
SUSE CVE-2026-80691
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...
SUSE CVE-2026-80695
In the Linux kernel, the following vulnerability has been resolved: hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3xupdateclient, the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16tocpup. The pointers passed to this function are...
SUSE CVE-2026-80708
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in ccaclr2cipherkey The helper function ipcprbhelper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could lead ...
SUSE CVE-2026-80718
In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpucreatechunk In pcpucreatechunk, nrpages is the total contiguous backing allocation, i.e., nrunits pcpuunitpages, but pcpuchunkpopulated uses it to set chunk-populated, whose...
Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory
Summary aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlinkf.LinkTarget, dstPath without validating that the symlink target resolves inside the extraction destination. A...
GHSA-MF5C-HW34-4HPP Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory
Summary aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlinkf.LinkTarget, dstPath without validating that the symlink target resolves inside the extraction destination. A...
EUVD-2026-67795
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...
CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...
CVE-2026-82264
Duplicacy through 3.2.5 is affected by a path traversal vulnerability in its restore function. The root cause is a failure to validate entry paths deserialized from snapshot files, allowing an attacker to craft malicious snapshot entries containing directory traversal sequences that write files o...
CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...
CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...
CVE-2026-82112
A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component codetaskfiles. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called...
CVE-2026-38638
An issue in the withargv function /unistd/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-37710
Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...