CVE-2025-66277: Improper Link Resolution Before File Access

A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build...

The vulnerability of the f2fsPutSuper() function in the fs/f2fs/super.c module of the F2FS file system in Linux operating systems allows a hacker to cause a service failure.

The vulnerability of the f2fsputsuper function in the fs/f2fs/super.c module of the F2FS file system in Linux operating systems is related to errors during link counters updates. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: - Denial-of-Service DoS - Manipulation of data - Accessing sensitive data - Execution of arbitrary code user privileges -...

CVE-2026-21253

Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally...

CVE-2026-21253

Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally...

CVE-2026-21253

Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally...

CVE-2026-21253 Mailslot File System Elevation of Privilege Vulnerability

...

CVE-2026-21253

CVE-2026-21253 is a Windows vulnerability in the Mailslot File System described as a use-after-free issue that can enable local privilege escalation. The CVE’s CVSS 3.1 score is 7.0 (HIGH) with a local attack vector, high attack complexity, and requires low privileges and no user interaction. The...

CVE-2026-21253 Mailslot File System Elevation of Privilege Vulnerability

...

CVE-2026-25992

SiYuan before 3.5.5 exposes a vulnerability in the /api/file/getFile endpoint: it uses case-sensitive equality checks to block access on case-insensitive file systems (e.g., Windows). An attacker can bypass restrictions via mixed-case paths and read protected configuration files. Impact is confid...

Mailslot File System Elevation of Privilege Vulnerability

Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally...

kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

A flaw null pointer dereference in the Linux kernel NFS functionality was found in the way client does some specific action for existing NFS connection. A client user could use this flaw to crash the server system...

[SECURITY] Fedora 43 Update: rust-btrd-0.5.3-12.fc43

The btrfs debugger...

File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

Summary An authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes e.g., //private/ to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting...

KLA90878 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, bypass security restrictions, spoof user interface, obtain sensitive information, cause denial of service. Below is a...

PT-2026-7356

Name of the Vulnerable Software and Affected Versions Mailslot File System affected versions not specified Description A flaw exists in the Mailslot File System that could allow a local attacker to gain elevated privileges. The issue is a use-after-free condition. An attacker can exploit this to...

AlmaLinux 8 : kernel (ALSA-2026:2264)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2264 advisory. kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it CVE-2025-38403 kernel: net: use dstdevrcu in sksetupcaps CVE-2025-40170...

The vulnerability of the __udf_iget() function in the fs/udf/inode.c file of the Linux kernel file system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the udfiget function in the fs/udf/inode.c file of the Linux kernel file system is related to insufficient checking of exception states. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the ext4_io_end_defer_completion() function in the fs/ext4/page-io.c file of the Ext4 file system of the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the ext4ioenddefercompletion function in the fs/ext4/page-io.c file of the Ext4 file system in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the f2fs_mapblocks() function in the fs/f2fs/data.c module of the F2FS file system in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the f2fsmapblocks function in the fs/f2fs/data.c module of the F2FS file system in the Linux operating system is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow a perpetrator to cause service failures...