CVE-2026-63808

CVE-2026-63808 (Linux kernel exFAT): The vulnerability is a potential use-after-free in exfat_find_dir_entry() where a buffer_head is freed before all reads on the TYPE_EXTEND path, leading to a read from invalid memory. The root cause is brelse(bh) occurring before ep is no longer dereferenced; ...

OESA-2026-3021 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-3018 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

CVE-2026-53367 selinux: fix avdcache auditing

In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the audited vector computed by avcauditrequired rather than recomputing based on the currently requested permissions and distinguishing the...

PT-2026-61124

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the exfat find dir entry function. The problem occurs when a buffer head obtained from exfat get dentry is released using brelsebh before the TYPE EXTEND...

PT-2026-61357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cachefiles module where the system fails to correctly extract the error code when the vfs mkdir function fails. This results in the mkdir error logic being trigger...

Linux Distros Unpatched Vulnerability : CVE-2026-63808

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - exfat: fix potential use-after-free in exfatfinddirentry In exfatfinddirentry, the bufferhead obtained from exfatgetdentry is released with brelsebh before the...

PT-2026-61502

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sysfs component where the internal create group function incorrectly calls kernfs removekn on a group directory when create files fails for example, due to -ENOMEM...

Directory Traversal

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal via the WebSocket routing. An attacker can access unintended upstream endpoints by sending crafted WebSocket upgrade requests containing path traversal...

CVE-2026-9323

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

CVE-2026-9323 Insecure PRNG and Information Exposure in urwid Web Display Backend

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

CVE-2026-47871

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 fixed in 32.1.2 31.1.1 through 31.2.2 fixed in 31.2.2-2p3 30.1.1 through 30.2.6 fixed...

CVE-2026-47871

The CVE-2026-47871 issue affects VMware Avi Load Balancer and is a directory traversal vulnerability caused by flaws in file path validation. Affected versions and fixed milestones are: 32.1.1 (fixed in 32.1.2); 31.1.1–31.2.2 (fixed in 31.2.2-2p3); 30.1.1–30.2.6 (fixed in 30.2.7); and 22.1.1–22.1...

CVE-2026-47871 VMware Avi Load Balancer Directory Traversal Vulnerability

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 fixed in 32.1.2 31.1.1 through 31.2.2 fixed in 31.2.2-2p3 30.1.1 through 30.2.6 fixed...

EUVD-2026-45366

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 fixed in 32.1.2 31.1.1 through 31.2.2 fixed in 31.2.2-2p3 30.1.1 through 30.2.6 fixed...

Updated python-pydantic-settings packages fix a security vulnerability

The updated packages fix a security vulnerability: NestedSecretsSettingsSource follows symlinks outside secretsdir, enabling local file read and bypassing secretsdirmaxsize. CVE-2026-58203...

MGASA-2026-0260 Updated python-pydantic-settings packages fix a security vulnerability

The updated packages fix a security vulnerability: NestedSecretsSettingsSource follows symlinks outside secretsdir, enabling local file read and bypassing secretsdirmaxsize. CVE-2026-58203...

Linux Distros Unpatched Vulnerability : CVE-2026-50162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath in content/file/file.go uses a lexical filepath.Rel check for workingDir an...

CVE-2026-48049

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...

CVE-2026-48049 @hapi/inert: Static-file confinement bypass via sibling-prefix path

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...