DEBIAN-CVE-2026-68448

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

CVE-2026-68448

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

CVE-2026-68448 ovl: check access to copy_file_range source with src mounter creds

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

EUVD-2026-57054

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

CVE-2026-68448

The CVE-2026-68448 entry concerns the Linux kernel overlayfs copy_file_range path. Previously, cross-filesystem copy could proceed using the destination overlayfs’s mounter credentials, with the source file’s read path checked using the destination’s credentials. This could deny a permitted copy ...

CVE-2026-68448 ovl: check access to copy_file_range source with src mounter creds

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...

PT-2026-70981

Name of the Vulnerable Software and Affected Versions Zephyr OS affected versions not specified Description The PSA Protected Storage credential backend in subsys/net/lib/tls credentials/tls credentials trusted.c fails to initialize the credential lock mutex. Because the mutex is declared as a...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

CVE-2026-73246 Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

CVE-2026-67568

The CVE-2026-67568 entry concerns Mira Android APK v4.5.15.4, where an attacker could read/write reproductive health profiles from internet-connected hosts, enabling forgery, deletion, or destruction of health information. Public metrics show a critical impact (CVSS 3.1/3.1: 9.1; CVSS 4.0/4.0: 9....

CVE-2026-67568 Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2026-33922

A flaw was found in Arc. This path traversal vulnerability exists within the Offline archives functionality of the local web interface. A local user with administrative credentials can exploit this by submitting an archive name containing special characters, allowing them to delete arbitrary file...

CVE-2026-71390

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user...

CVE-2026-71389

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

CVE-2026-48446

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...

CVE-2026-48439

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...

CVE-2026-48442

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside th...

CVE-2026-48444

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not requir...

CVE-2026-48438

CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user...