CVE-2026-96225: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

vifm -- Unverified Ownership

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkX7Pmiofg reports: Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vi...

Ubuntu 26.04 LTS : sudo-rs vulnerability (USN-8708-1)

The remote Ubuntu 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8708-1 advisory. It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : p11-kit vulnerabilities (USN-8687-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8687-1 advisory. It was discovered that p11-kit incorrectly handled certain RPC messages. A local attacker could use this issue to cau...

CVE-2026-97792: Incorrect Permission Assignment for Critical Resource

Improper access control in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-69969: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows AppX Deployment Service allows an authorized attacker to disclose information locally...

CVE-2026-108941 Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local...

CVE-2026-108941

The Linketic CityGaussian software (versions up to 2.0 ) contains a code injection vulnerability within the Sidecar Parsing component. Specifically, the parse_cfg_args function in the internal/utils/common.py file is susceptible to exploitation because the manipulation of the cfg_args argument al...

CVE-2026-17484 IBM i is Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control...

CVE-2026-18343 IBM i is Affected By An Improper Privilege Management Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization...

CVE-2026-18343 IBM i is Affected By An Improper Privilege Management Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization...

CVE-2026-18343

IBM i versions 7.3, 7.4, 7.5, and 7.6 (all 5770-SS1) are vulnerable to an Improper Privilege Management vulnerability (CWE-269 ). This flaw allows a local attacker to modify the BOOTP table due to insufficient authorization. The vulnerability carries a CVSS v3.1 base score of 4.4. Remediation is ...

CVE-2026-92832

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information...

CVE-2026-75782

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable...

CVE-2026-75621

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 are vulnerable to a security issue where a local attacker could obtain sensitive information. The root cause is the assignment of excessive permissions to a service account (CWE-250). To remediate this vulnerability, IBM strongly recommen...

CVE-2026-75621 IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account...

CVE-2026-75621 IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account...

CVE-2026-92832 IBM Aspera Enterprise Webapps Information Disclosure

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information...

Exploit for Privilege Chaining in Canonical Ubuntu_Linux

CVE-2026-3888: snap-confine and systemd-tmpfiles race This re...

CVE-2026-49484 Code for IBM i: Temporary files are visible to all users

Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where...