13551 matches found
CVE-2026-64392 ksmbd: use opener credentials for delete-on-close
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run...
CVE-2026-64392
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run...
CVE-2026-64392
The CVE-2026-64392 entry concerns the Linux kernel ksmbd delete-on-close path. The underlying issue was that delete-on-close could execute unlink and ADS xattr removal with ksmbd worker credentials rather than the credentials captured at file open, allowing potential permission checks bypass. The...
PT-2026-64612
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where Alternate Data Streams ADS, which are stored as extended attributes xattrs, do not use the credentials captured when the SMB handle was opened...
Linux Distros Unpatched Vulnerability : CVE-2026-64398
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after...
EUVD-2026-48570
A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...
CVE-2026-16743
The CVE-2026-16743 entry concerns accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop done by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to...
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()
...
OESA-2026-3150 sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...
OESA-2026-3147 sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...
SUSE CVE-2026-15792
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...
DEBIAN-CVE-2026-60122
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...
CVE-2026-60122 gpsd gpsprof Code Injection via SKY.satellites used Field
gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...
CVE-2026-60122
gpsd (up to release 3.27.5) contains a code-injection vulnerability in the gpsprof utility via the SKY.satellites[].used field. The value is unsanitized before being inserted into a gnuplot heredoc, allowing an attacker who controls GPS input data to terminate the heredoc with EOD and inject gnup...
Oracle Linux 9 : sssd (ELSA-2026-42122)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42122 advisory. - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege...
EUVD-2026-47788
An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...
CVE-2026-55973
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...
CVE-2026-55973
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...
CVE-2026-55973
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option code 18 from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain...
CVE-2026-50046
In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...