CVE-2026-88514

A vulnerability in iTerm2 for macOS before version 3.6.12 allows a local attacker to obtain sensitive information . The issue is associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). While the documents confirm the existence of the vulnerability and its impact on c...

PT-2026-107422

This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it...

Linux Distros Unpatched Vulnerability : CVE-2026-106399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a craft...

Linux Distros Unpatched Vulnerability : CVE-2026-106451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive tempora...

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

When no system-installed liblz4-java is found, net.jpountz.util.Native.load extracts the bundled native library to java.io.tmpdir and loads it with System.load. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive creation...

Security update for wpa_supplicant (important)

openSUSE security update: security update for wpasupplicant ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22022-1 Rating: important References: bsc1280914 Cross-References: CVE-2026-78807 CVSS scores: CVE-2026-78807 SUSE : 7.1...

CVE-2026-106587

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled...

SUSE CVE-2026-106186

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: Low...

SUSE CVE-2026-106306

Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-106313

Incorrect authorization in Browser in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

SUSE CVE-2026-106340

Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. Chromium security severity: Low...

CVE-2026-106326

A confused deputy flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/511745101...

CVE-2026-80048

A flaw was found in "sssd-kcm". A local user or process able to connect to the "sssd-kcm" UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory...

CVE-2026-80048

A flaw was found in sssd-kcm. A local user or process able to connect to the sssd-kcm UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory...

CVE-2026-104046

A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...

UBUNTU-CVE-2026-104045

A flaw was found in SSSD. A local user can trigger a Denial of Service DoS by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause...

CVE-2026-79808

A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an authenticated local user to execute arbitrary code with elevated privileges on the affected host or to disrupt the availability of the affected service...

CVE-2026-79812

A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an authenticated local attacker to interrupt the normal operation of the agent service...

DEBIAN-CVE-2026-106451

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-104047

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause...