EUVD-2026-87688

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

CVE-2026-100715 Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

CVE-2026-100715

Froxlor versions through 2.3.10 are vulnerable to arbitrary file deletion due to a symlink following flaw in the FTP data deletion cron task (deleteFtpData ). The vulnerability occurs because the FileDir::makeCorrectDir() function is called without the $fixed_homedir argument, causing the symlink...

Astra Linux – Vulnerability in Qemu

A heap-based buffer overflow was discovered in QEMU version 5.0.0 in the SDHCI device emulation support. This vulnerability could occur during a multi-block SDMA transfer using the sdhcisdmatransfermultiBlocks routine in the hw/sd/sdhci.c file. A malicious user or process could exploit this flaw ...

CVE-2026-63807

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 memory management unit MMU. A malicious guest operating system could create a hugepage mapping that extends beyond the boundaries of its allocated memory slot. This improper handling of memory boundaries by KVM can lead t...

web2py is vulnerable to password brute-force attack

web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks...

PYSEC-2026-569 web2py is vulnerable to password brute-force attack

web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks...

Security update for qemu

This update for qemu fixes the following issues: CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto bsc1255400. CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption bsc1256484. CVE-2026-2243: incorrect bounds check leads to heap...

UBUNTU-CVE-2026-45890

In the Linux kernel, the following vulnerability has been resolved: xen-netback: reject zero-queue configuration from guest A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect function in the backend only validates the upper bound requestednumqueue...

CVE-2026-43214

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for x86 architectures. When reading Page Directory Pointer Table Registers PDPTRs in the getsregs2 function, the system fails to use proper Sleepable Read-Copy Update SRCU protection. This oversight can lead to incorrect memo...

CVE-2023-31364

Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine VM to flood a host with writes, potentially causing a fatal machine check error resulting in denial of service...

CVE-2023-31364

Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine VM to flood a host with writes, potentially causing a fatal machine check error resulting in denial of service...

PT-2026-22189

Name of the Vulnerable Software and Affected Versions versions affected versions not specified Description A flaw exists due to improper handling of direct memory writes in the input-output memory management unit. A malicious guest virtual machine VM could potentially overwhelm the host with writ...

CVE-2025-14876 Qemu-kvm: unbounded allocation in virtio-crypto

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service DoS on the host system by causing the QEMU process to terminate...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002295)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002295 advisory. The getrxbufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux RHEL 6 does n...

EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2026-1067)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 throug...

EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2026-1087)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 throug...

AZL-70547 CVE-2025-31133 affecting package kubernetes for versions less than 1.28.4-21

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount i.e., the container's /dev/null was...

CVE-2025-31133

CVE-2025-31133 (runc) affects the runc runtime when using certain bind-mount sources, where verification of the source inode for "/dev/null" could be bypassed. Affected versions include 1.2.7 and earlier, 1.3.0-rc.1 through 1.3.1, and 1.4.0-rc.1 and 1.4.0-rc.2. The issue enables an attacker to pe...

CVE-2025-31133

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount i.e., the container's /dev/null was...