DEBIAN-CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

CVE-2026-76222 GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...

CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

CVE-2026-74414

A flaw was found in the Linux kernel's HFS Plus hfsplus filesystem. A local user could trigger a null-pointer dereference by executing the setxattr function in userspace when the attributes file is not properly loaded during system mount. This vulnerability is caused by a duplicate attribute inod...

CVE-2026-74362

A flaw was found in the Linux kernel's ext2 filesystem. When performing write operations on files opened with OSYNC or ODSYNC flags, the system call write2 could incorrectly report success to a local user even if the data synchronization to disk failed. This could lead to data integrity issues, a...

CVE-2026-74319

A flaw was found in the btrfs zoned filesystem within the Linux kernel. When performing data relocation, the system can enter a deadlock state. This happens because the relocation process waits for a space reservation ticket that cannot be fulfilled, as the relocation itself is the operation...

CVE-2026-72374

A flaw was found in the Linux kernel's AFS filesystem client. The AFS client uses an rxrpc server for callback notifications. Its message parsers incorrectly convert the -EAGAIN return value to 0 when the last packet has not been fully received but all currently queued data is consumed. This...

CVE-2026-72031

A flaw was found in the Linux kernel's libata-core component. When a PNY CS900 1TB SSD enters Device-Initiated Slumber during idle, it can drop off the bus and become unresponsive. This issue prevents the system from accessing the drive, forcing the filesystem into a read-only state, which result...

PT-2026-78459

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper authentication allows a remote attacker to gain unauthorized access to NFS-exported filesystems. NFS Network File System is a distributed file system protocol that...

PT-2026-78472

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description Incorrect default permissions allow a low privileged attacker with local access to potentially gain filesystem access. Recommendations Update Dell Command Update DCU to version 5.7.1 ...

CVE-2026-53458

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in customcomponents/blueprintstudio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could conta...

CVE-2026-53457

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-53454

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53456

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...

USN-8636-2: Linux kernel (Oracle) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Media drivers; - Network drivers; - Mellanox network drivers; - Texas...

CVE-2026-53457 Blueprint Studio terminal command working directory not bounded to config directory

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-53457 Blueprint Studio terminal command working directory not bounded to config directory

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-53456

In Blueprint Studio versions before 2.5.2, the SSH terminal authentication component in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private-key material to a file under the Home Assistant configuration directory, applied restrictive permissions afterward, and relied o...

CVE-2026-53456 Blueprint Studio terminal SSH private key written to disk

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...

CVE-2026-53456 Blueprint Studio terminal SSH private key written to disk

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...