CVE-2026-72694

CVE-2026-72694 describes a local privilege escalation in MRTG. When MRTG runs as root and then drops privileges, a low-privileged attacker can exploit a symlink-following vulnerability in the PID file path to trick the root process into changing ownership of an arbitrary existing file to the daem...

EUVD-2026-55977

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

[SECURITY] Fedora 43 Update: libcupsfilters-2.1.1-9.fc43

Libcupsfilters provides a library, which implements common functions used in cups-browsed daemon and printing filters, and additional files as banner templates and character sets. The filters are used in CUPS daemon and in printer applications...

[SECURITY] Fedora 43 Update: xen-4.20.4-1.fc43

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

PT-2026-70085

Name of the Vulnerable Software and Affected Versions MRTG affected versions not specified Description A flaw exists when the MRTG daemon is started as a root user and subsequently drops privileges. A local, low-privileged attacker can exploit a symbolic link symlink following vulnerability by...

PT-2026-80179

GHSA-38fq-mrrg-8rmr: RtlTcp: malformed greeting causes daemon exit...

DEBIAN-CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68153

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

EUVD-2026-55544

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

CVE-2026-68083 ksmbd: fix path resolution in ksmbd_vfs_kern_path_create

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

CVE-2026-68173: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

[SECURITY] Fedora 43 Update: udisks2-2.11.2-1.fc43

The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies...

[SECURITY] Fedora 43 Update: bird-3.3.2-1.fc43

BIRD is a dynamic IP routing daemon supporting both, IPv4 and IPv6, Border Gateway Protocol BGPv4, Routing Information Protocol RIPv2, RIPng, Open Shortest Path First protocol OSPFv2, OSPFv3, Babel Routing Protocol Babel, Bidirectional Forwarding Detection BFD, IPv6 router advertisements, static...

[SECURITY] Fedora 44 Update: bird-3.3.2-1.fc44

BIRD is a dynamic IP routing daemon supporting both, IPv4 and IPv6, Border Gateway Protocol BGPv4, Routing Information Protocol RIPv2, RIPng, Open Shortest Path First protocol OSPFv2, OSPFv3, Babel Routing Protocol Babel, Bidirectional Forwarding Detection BFD, IPv6 router advertisements, static...

CVE-2026-68082 libceph: fix two unsafe bare decodes in decode_lockers()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...

EUVD-2026-54775

In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...