EUVD-2026-60974

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a...

CVE-2026-72460

A flaw was found in the Linux kernel's AppArmor security module. When changing a security profile, the aachangeprofile function might attempt to use an invalid security label before properly checking if the label was successfully created. This oversight could allow a local attacker to trigger a...

EUVD-2026-60940

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

CVE-2026-72151

A flaw was found in the Linux kernel's Trusted Platform Module TPM2 session handling. Specifically, the tpmbufappendsalt function does not properly manage asynchronous cryptographic key operations. This oversight can lead to a use-after-free vulnerability, where the system attempts to access memo...

attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr

A flaw was found in the attr package. This vulnerability allows a local attacker to perform a symlink traversal attack by replacing a pathname component with a symbolic link - either during directory hierarchy traversal by getfattr or during backup restoration by setfattr, which reads and resolve...

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...

CVE-2026-72419

A flaw was found in the Linux kernel's netfilter component. This vulnerability arises from a type confusion due to an invalid pointer use within the nfnat module when its initialization fails. A local attacker could exploit this issue by triggering the failed initialization, potentially causing a...

CVE-2026-72236

A flaw was found in the Linux kernel's s390 performance monitoring component s390/perfcpumcf. A userspace-controlled variable was used as an array index without proper speculation barriers. This could allow a local attacker to potentially exploit speculative execution, leading to information...

CVE-2026-72387

A flaw was found in the drm/panthor component of the Linux kernel. This vulnerability, located in the groupprocesstileroom function, occurs when error pointers are improperly handled, leading to an invalid memory dereference. A local attacker could potentially exploit this flaw to cause a system...

CVE-2026-72138

A flaw was found in the xen/gntdev component of the Linux kernel. When the gntdevioctlmapgrantref function fails to copy operation results back to userspace, it does not properly release a memory reference. This oversight can lead to a memory leak and a corrupted list entry. A local attacker coul...

CVE-2026-72300

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ASoC Sound Open Firmware SOF topology component. The sofparsetokensets function fails to properly validate the size of the vendor array when parsing topology private data. A local attacker could exploit this by providing...

CVE-2026-72160

A flaw was found in ocfs2 Oracle Cluster File System version 2 in the Linux kernel. This vulnerability arises from insufficient validation of on-disk inode metadata, specifically the imode type bits. A local attacker could exploit this by crafting a malformed disk inode with a non-canonical POSIX...

PT-2026-78101

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.14 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. This issue can lead to unauthorized access t...

PT-2026-77410

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 Description A flaw in the Data Mover component allows a high-privileged attacker with access to the execution infrastructure to compromise the system. Exploitation...

PT-2026-78132

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Financial...

PT-2026-78130

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Financial...

PT-2026-78067

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM MCAD Connector version 3.6 Description A flaw in the CAX Client component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Exploitation is difficult and...

PT-2026-78077

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM MCAD Connector version 3.6 Description An issue exists in the CAX Client component of the Oracle Agile PLM MCAD Connector. An unauthenticated attacker with access to the infrastructure where the software executes can compromis...

PT-2026-78072

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM MCAD Connector version 3.6 Description A flaw in the CAX Client component allows a high-privileged attacker with access to the infrastructure where the software executes to compromise the system. Exploitation is difficult and...

PT-2026-78085

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0 Description A flaw in the Platform Security component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the system...