CVE-2026-93243

A flaw was found in the Linux kernel's secret memory secretmem subsystem. A local user can bypass locked memory resource limits by repeatedly mapping and unmapping secret memory ranges. Because the kernel fails to properly track these unevictable memory pages against user limits, an unprivileged...

CVE-2026-93241

A flaw was found in the Linux kernel. When the out-of-memory OOM killer terminates a multi-threaded process and asynchronous memory cleanup cannot complete, exiting threads continue to invoke memory reclamation and serialize behind an internal lock. A local user can exploit this vulnerability by...

CVE-2026-93226

A flaw was found in the Linux kernel's IPv6 networking subsystem. A race condition occurs when reading route exception lists without proper synchronization against concurrent route updates. A local user can trigger this flaw by querying network routing tables during simultaneous route updates,...

CVE-2026-93206

A flaw was found in the Linux kernel. This vulnerability allows an unprivileged local attacker to bypass security restrictions. By obtaining a file descriptor from a privileged process, the attacker can read the entire Peripheral Component Interconnect PCI configuration space, which could lead to...

CVE-2026-90019

A flaw was found in the Linux kernel. A null pointer dereference can occur in the usbputfunctioninstance function within the USB gadget subsystem. This issue arises because a file descriptor fd is not allocated before being dereferenced in an error path, which can lead to a system crash. A local...

CVE-2026-89874

A flaw was found in the Linux kernel's v4l2-async media subsystem. When creating ancillary media links, the v4l2asyncmatchnotify function attempts to delete an unlinked entry if the link creation fails. This can lead to a null pointer dereference, potentially causing a system crash. A local...

CVE-2026-89808

A flaw was found in the drm/amdkfd component of the Linux kernel. During virtual memory VM migration, if a VM range is a 'hole' on the CPU side, an uninitialized variable is used. This can cause the system to drop all Video Random Access Memory VRAM, potentially leading to a denial of service or...

CVE-2026-98499

A flaw was found in the Linux kernel's Wacom Human Interface Device HID driver. When processing a device report descriptor with mismatched usage and count configurations, the driver can calculate an invalid memory offset and perform an out-of-bounds read beyond the allocated report buffer. A loca...

CVE-2026-96234

A flaw was found in .NET. An origin validation error allows an unauthorized remote attacker to disclose sensitive information over the network. Successful exploitation requires user interaction and enables an attacker to access restricted data without proper authorization...

CVE-2026-96990

A flaw was found in Apache Thrift's Erlang bindings. A remote, unauthenticated attacker could exploit this vulnerability by sending requests that trigger excessive resource allocation without proper limits or throttling. This issue can lead to resource exhaustion, resulting in a Denial of Service...

CVE-2026-96287

A flaw was found in the Apache Thrift Perl bindings. A remote attacker could exploit this vulnerability by sending specially crafted input to an application using the affected bindings. This triggers inefficient data processing, leading to excessive resource consumption and a Denial of Service Do...

UNIX Hard Link

Overview Affected versions of this package are vulnerable to UNIX Hard Link via OsFiles.overwrite in SoftReadWriteLock, which refreshes holder records by name without verifying the file identity. A local attacker who has rename access to the lock directory can replace a holder record with a named...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the lock file open logic in api.py and related platform backends, where an existing lock file's permissions are not preserved on Unix systems. An attacker with local access can observe the file mode applied to a newly...

Unverified Ownership

Overview Affected versions of this package are vulnerable to Unverified Ownership via the strict lock implementation in strict.py and related claim directory handling, where mkdirmode=0o700 only enforces private permissions when it creates the directory and the subsequent lstat check reads neithe...

Race Condition Enabling Link Following

Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following via SoftFileLock.trybreakstalelock in src/filelock/soft.py, which can restore a stale marker by name after moving it aside. A local attacker with rename access in a non-sticky lock directory can sw...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via ReadWriteLock in src/filelock/readwrite.py, which resolves the lock file path using Path.resolve before passing it to sqlite3.connect. An attacker who can plant a symlink in a shared lock directory can cause the victi...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the strict lock implementation in strict.py and related soft read-write storage code, where claim directories are created without being restricted to the owning account. A local attack...

CVE-2026-28331

The SolarWinds Patch Manager software is susceptible to a Sensitive Information Exposure vulnerability (CWE-200). This flaw allows local users to access sensitive information, which could potentially be leveraged to gain elevated privileges . The vulnerability has a CVSS 3.1 base score of 4.4 (Me...

CVE-2026-28331 SolarWinds Patch Manager Sensitive Information Exposure Vulnerability

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges...

CVE-2026-28331 SolarWinds Patch Manager Sensitive Information Exposure Vulnerability

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges...