27976 matches found
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in EncryptionIO.kmsrequest and EncryptionIO.fetchkeys, which pass the endpoint through parsehost and on to createconnection unchanged when it ends in .sock, so the connection code interprets it as a Unix...
CVE-2026-85057
ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...
SUSE CVE-2026-88832
BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...
SUSE CVE-2026-92700
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...
EUVD-2026-86240
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...
CVE-2026-93235 f2fs: fix to zero post-EOF data when extending file size
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...
Guest can panic host through filesystem datetime overflow
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0314 Guest can panic host through filesystem datetime overflow
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Missing authorization in the FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Missing authorization in the FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Improper handling of case sensitivity in the FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...
CLEANSTART-2026-NP36052 Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data"
Security vulnerability affects the airflow-3 package. Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data"...
EUVD-2026-85702
A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...
PT-2026-98201
Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 3.4.12 ZITADEL versions 4.0.0 through 4.16.0 Description ZITADEL Actions V1 allows an organization Action author with ORG OWNER, org.action.write, and org.flow.write permissions to read files from the host...
CVE-2026-93235: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...
Linux Distros Unpatched Vulnerability : CVE-2026-92700
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses...
PT-2026-98108
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The bfs filesystem fails to properly handle set blocksize failures. Because bfs utilizes buffer heads, it cannot effectively manage block sizes that exceed the PAGE SIZE. This issue lead...
CVE-2026-93235
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...