CVE-2026-47626

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...

EUVD-2026-65603

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...

CVE-2026-24262

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...

EUVD-2026-65602

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...

CVE-2026-24262

NVIDIA DGX Spark contains an out-of-bounds write vulnerability in its system firmware . A privileged local attacker can exploit this to achieve code execution , privilege escalation , denial of service , information disclosure , or data tampering . The CVSS 3.1 score is 8.2 (HIGH) , reflecting a ...

CVE-2026-2035366

A flaw was found in OpenStack Keystone where an application credential token can escape its intended project scope through token-method reauthentication. Keystone rejects an explicit scope change for an application credential token, but an omitted scope falls through to the owner's default projec...

CVE-2026-2035364

A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, application credential, and OAuth1 authorization endpoints. Tokens obtained via delegated authentication methods, such as OAuth1 access tokens or custom Keystone authentication plugins, can...

CVE-2026-79783

rclone before 1.74.4 contains a privilege escalation vulnerability in its local backend . The root cause is a failure to mask special permission bits (setuid/setgid) when applying source-supplied mode metadata. An attacker who controls a remote source can plant a setuid binary by copying files wi...

CVE-2026-79783 rclone before 1.74.4 Privilege Escalation via setuid Metadata

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid...

CVE-2026-79783

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid...

EUVD-2026-65541

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid...

CVE-2026-79783 rclone before 1.74.4 Privilege Escalation via setuid Metadata

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid...

CVE-2026-78360

A missing authorization flaw was found in Anitya. The user deletion endpoint checks that the caller is logged in but does not check that the caller is an administrator. Any authenticated user can delete arbitrary user accounts, including administrator accounts, which can remove administrative...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.35 bug fix and security update

Red Hat OpenShift Container Platform release 4.20.35 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.30 bug fix and security update

Red Hat OpenShift Container Platform release 4.21.30 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

CVE-2026-15060

A flaw was found in systemd-machined. When systemd-machined is running on a desktop system, an unprivileged user logged into a desktop graphical session can terminate arbitrary processes, including privileged ones. This could lead to a denial of service or potentially allow for privilege...

Moderate: Red Hat Security Advisory: attr security update

An update for attr is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr

A flaw was found in the attr package. This vulnerability allows a local attacker to perform a symlink traversal attack by replacing a pathname component with a symbolic link - either during directory hierarchy traversal by getfattr or during backup restoration by setfattr, which reads and resolve...

Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips. Security issues fixed: CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to...

SUSE-SU-2026:3799-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips. Security issues fixed: - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead t...