CVE-2026-74308

A flaw was found in the Linux kernel's ext4 filesystem. When the data=journal mount option is enabled, the ext4journalledwriteend function can incorrectly attempt to write inline data. This occurs if a prior attempt to convert inline data to an extent failed, leading to an inconsistent state. An...

CVE-2026-74307

A flaw was found in the Linux kernel's ext4 filesystem. A local attacker can trigger a deadlock by performing an EXT4IOCMOVEEXT ioctl operation with a donor file from a different filesystem during a concurrent freeze operation. This late validation creates a circular lock dependency, leading to a...

CVE-2026-18273 Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability

Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged...

CVE-2026-63043

Apache InLong versions 2.0.0 through 2.3.x are vulnerable to a Relative Path Traversal vulnerability. This flaw occurs due to an unvalidated file source path , allowing an attacker to perform arbitrary file reads from the Agent host filesystem by manipulating file path variables to access directo...

EUVD-2026-63475

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1 https://github.com/apache/inlong/pull/12146...

CVE-2026-64963 Path Traversal in ATutor

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the ATFORCEGETFILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure. Product is no...

RUSTSEC-2026-0269 Filesystem sandbox escape when paths or symlinks contain trailing slashes

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory...

Filesystem sandbox escape when paths or symlinks contain trailing slashes

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory...

kernel: udf: fix partition descriptor append bookkeeping

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could exploit this vulnerability by tricking a user into mounting a specially crafted UDF image containing repeated partition descriptors. This could lead to a heap out-of-bounds write, potentially...

kernel: udf: fix partition descriptor append bookkeeping

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could exploit this vulnerability by tricking a user into mounting a specially crafted UDF image containing repeated partition descriptors. This could lead to a heap out-of-bounds write, potentially...

PT-2026-79257

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Insufficient validation allows a local attacker to cause kernel memory corruption. A crafted filesystem image can trigger an out-of-bounds kernel-stack write during director...

Securing Filesystems for Confidential Computing

Confidential computing protects applications inside Trusted Execution Environments TEEs, but it leaves storage vulnerable. Even with disk encryption, a malicious cloud provider can roll back, replay, fork, or tamper with disk state, breaking the integrity and freshness guarantees required by...

PT-2026-79011

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT FORCE GET FILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure. Product is no...

CVE-2026-63043: Relative Path Traversal

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1 https://github.com/apache/inlong/pull/12146...

PT-2026-79051

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description A relative path traversal issue allows for arbitrary file read operations from the Agent host filesystem. Path traversal is a flaw that allows an attacker to access files and directories...

CVE-2026-19783: Out-of-bounds Write

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause kernel memory corruption due to insufficient validation. A crafted filesystem image can trigger an out-of-bounds kernel-stack write during directory reads, causing a system crash or potentially enabling privilege...

CVE-2026-18273: Incorrect Default Permissions

Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged...

The vulnerability of the fs/gfs2 component in Linux operating systems, which allows a hacker to trigger a service failure

The vulnerability of the fs/gfs2 component in Linux operating systems is related to the allocation of unlimited memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-79075

Name of the Vulnerable Software and Affected Versions broot affected versions not specified Description broot renders file and directory names in its interactive tree view exactly as they are read from the filesystem without filtering control characters. This occurs during the conversion process...

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Summary The default .htaccess shipped with Grav and the reference webserver-configs/htaccess.txt contains security rules that block direct HTTP access to sensitive file types .yaml, .yml, .php, .json, .twig, etc. under user/ and system/vendor/ directories. However, these rules lack the NC No Case...