CVE-2026-107332: Incorrect Default Permissions

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later...

PT-2026-108197

Name of the Vulnerable Software and Affected Versions Intego Antivirus for Windows versions prior to 3.0.0.1 Description A link following issue exists in the optimization module. This allows local unprivileged users to delete arbitrary folders with SYSTEM privileges. An attacker can replace the...

CVE-2026-84250: Use of Hard-coded Credentials

IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges...

PT-2026-108013

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description A...

EulerOS 2.0 SP15 : acl (EulerOS-SA-2026-3962)

According to the versions of the acl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions aclgetfile, aclsetfile, aclextendedfile, a...

Linux Distros Unpatched Vulnerability : CVE-2026-107565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS...

EulerOS 2.0 SP15 : pam (EulerOS-SA-2026-3931)

According to the versions of the pam packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-3947)

According to the versions of the qemu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command...

CVE-2026-87428: Insufficiently Protected Credentials

In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches...

PT-2026-107868

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...

GHSA-MCR4-QMVW-PX4G yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Summary When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive...

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Summary When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive...

CVE-2026-42617

A flaw was found in NTFS-3G. A heap-based buffer overflow occurs when expanding a directory on a specially crafted NTFS filesystem image, such as during file creation. A local attacker can exploit this vulnerability to corrupt memory within the privileged binary, potentially leading to arbitrary...

CVE-2026-106580

A flaw was found in ImageMagick. A missing security policy check in the CUT encoder allows a local attacker to execute a crafted encoding operation that bypasses established restrictions. Successful exploitation can lead to unauthorized data reading information disclosure or cause the application...

CVE-2026-93515

A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local ...

SUSE CVE-2026-104047

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause...

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

The @quasar/ssl-certificate development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesyst...

GHSA-FH39-C73X-5PJV Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

The @quasar/ssl-certificate development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesyst...

EUVD-2026-94447

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

CVE-2026-20032 Cisco NX-OS Software Python Sandbox Escape Vulnerability

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validati...