cowlib: cowlib: Link header smuggling allows out-of-band connections to attacker-controlled origins

A flaw was found in ninenines cowlib. This vulnerability, due to improper encoding or escaping of output, allows an attacker to perform Link header directive smuggling. By manipulating the target URI, 'rel' value, or attribute keys in applications that process Link headers through cowlib, a remot...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

CLSA-2026-1788972447 TuxCare security update for drupal/link (1 CVE)

TuxCare rebuilt drupal/link to address 1 CVE. Fixed in 7.1.13-p1+tuxcare...

CVE-2026-21098

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...

CVE-2026-21098

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...

CVE-2026-21098

CVE-2026-21098 is an improper access control vulnerability in Samsung's Link to Windows feature, affecting versions prior to SMR Sep-2026 Release 1 . A local attacker can establish a connection with the PC without proper user interaction , resulting in high impact on availability as scored by the...

EUVD-2026-74639

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...

CVE-2026-21098

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...

PT-2026-88832

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...

PT-2026-95863

TuxCare rebuilt drupal/link to address 1 CVE. Fixed in 7.1.13-p1+tuxcare...

CVE-2026-21098: Improper Access Control

Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...

Backblaze Personal Computer Backup bzfilelist Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...

Backblaze Personal Computer Backup bzserv Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...

Backblaze Personal Computer Backup bzbackup Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...

Backblaze Personal Computer Backup bzreports Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...

Backblaze Personal Computer Backup bztransmit Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...

The vulnerability of the a6xx_gpu_init() function in the drivers/gpu/drm/msm/adreno/a6xx_gpu.c file of the Direct Rendering Infrastructure (DRI) driver module in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the a6xxgpuinit function in the drivers/gpu/drm/msm/adreno/a6xxgpu.c file of the Direct Rendering Infrastructure DRI driver module in the Linux operating system is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the Windows Update Stack component allows attackers to escalate their privileges.

The vulnerability of the Windows Update Stack component in Windows operating systems is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow an attacker to increase their privileges...

openSUSE 16 Security Update : cpio (openSUSE-SU-2026:21747-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21747-1 advisory. - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended...

Patch Tuesday - September 2026

Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch...