Darkcloak

DARKCLOAK Linux process identity cloaking DARKCLOAK chains the manipulation of all userspace-visible identity sources into an 11-phase sequential pipeline that progressively transforms a process until it becomes indistinguishable from the impersonated one to userspace monitoring tools. To the bes...

EUVD-2026-106351

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Database and Comm SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards...

CVE-2026-87310

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Database and Comm SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards...

CVE-2026-87310

A vulnerability exists in the Database and Comm SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.5 ). A low-privileged attacker with network access via JDENET can easily exploit this flaw to compromise the product, potentially leading to a full takeover of the JD Ed...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: tracing/eprobes: Ensure that event probes are consistent with kprobes and uprobes. Currently, if the symbol “@” is attempted to be used with an event probe eprobes, it will cause a NULL pointer dereference crash. Both kprobes...

A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

A malicious SIM card can order the device it sits in to run commands of the attacker's choosing. On the cellular modules built into electric-vehicle chargers, industrial routers, and car telematics units, that is enough to take the whole device over. Researchers at the University of Birmingham an...

Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities Detection

Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. dot dot in the 1 file parameter to document.php or 2 backtopage parameter in a create action to comm/action/fiche.php. !/usr/bin/env...

CVE-2026-64512

In CVE-2026-64512, a Linux kernel issue in the ACPI CPPC module stems from field misuse of reg->access_width depending on reg->space_id. When using ACPI_ADR_SPACE_PLATFORM_COMM, access_width indicates the PCC region and can trigger UBSAN shift-out-of-bounds, as illustrated by UBSAN: shift-o...

CVE-2026-66006

lakeFS

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

EUVD-2026-24979

comm: FIFO/pipe inputs are drained before comparison data loss / hang...

GHSA-3WFC-MGPM-9RQ6 comm: FIFO/pipe inputs are drained before comparison (data loss / hang)

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The arefilesidentical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input pat...

GHSA-6GCW-W7CP-94G9 comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::fromutf8lossy, which replaces invalid UTF-8 byte sequences with the Unicode replacement character U+FFFD. This behavior differs from GNU comm, whic...

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::fromutf8lossy, which replaces invalid UTF-8 byte sequences with the Unicode replacement character U+FFFD. This behavior differs from GNU comm, whic...

SUSE: CVE-2026-1766: SUSE Linux Security Advisory

A flaw was found in GNOME localsearch previously known as tracker-miners MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM Comment tags. An attacker cou...

CVE-2024-55045

Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the taskmavobcentry function at /comm/taskcomm.c...

CVE-2024-55045

Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the taskmavobcentry function at /comm/taskcomm.c...

CVE-2024-55045: Buffer Copy without Checking Size of Input

Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the taskmavobcentry function at /comm/taskcomm.c...

OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option

A flaw was found in OpenSSH. This vulnerability arises from the incorrect handling of the authorizedkeys principals option in uncommon scenarios. Specifically, when a principals list is used with a Certificate Authority that includes comma characters, OpenSSH may misinterpret the input. This coul...