acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

RHEL 9 : acl (RHSA-2026:67140)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67140 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfac...

ROS-20260914-73-0047

The vulnerability of the Isolated Web Apps component in Google Chrome and Microsoft Edge is related to the use of functions with non-standard implementations. Exploiting this vulnerability can allow an attacker to cause a service failure using a malicious file...

[SECURITY] Fedora 45 Update: python-asteval-1.0.10-1.fc45

ASTEVAL is a safeish evaluator of Python expressions and statements, using Python's ast module. The idea is to provide a simple, safe, and robust miniature mathematical language that can handle user-input. The emphasis here is on mathematical expressions, and so many functions from numpy are...

EUVD-2026-75872

An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkCollisionCallback, execFSMCallback, planFromGlobalTraj in egoreplanfsm.cpp...

CVE-2026-71647

An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkCollisionCallback, execFSMCallback, planFromGlobalTraj in egoreplanfsm.cpp...

CVE-2026-49918

In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-64035

Infracost: Arbitrary file read via config-template readFile symlink traversal...

CVE-2026-49918

Multiple functions are susceptible to a possible out of bounds write resulting from an integer overflow . This vulnerability could allow for local escalation of privilege without requiring additional execution privileges or user interaction. While the specific affected software/hardware is not de...

acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

ROS-20260908-73-0092

The vulnerability of the Repo.blame and Repo.blameincremental functions in the GitPython library’s unsafegitrevisionoptions protection mechanism is related to the implementation or modification of arguments. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

PT-2026-87037

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

EulerOS 2.0 SP12 : glibc (EulerOS-SA-2026-3337)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content...

EulerOS 2.0 SP12 : glibc (EulerOS-SA-2026-3262)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content...

PT-2026-88249

In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-19634

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

EUVD-2026-72142

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

CVE-2026-19634

PostgreSQL Anonymizer is vulnerable to SQL injection in the anon.import_database_rules() and anon.import_roles_rules() functions. A user can craft a malicious JSON document with specially crafted object names; when a superuser subsequently calls one of these import functions, the injected code ex...

PT-2026-86536

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import database rules or anon.import roles rules, the malicious code is executed with...

CVE-2026-86152: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely...