acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

CVE-2026-14551

The servereye client also known as sensorhub, technically ClientAgentContainerService versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery EmergencyRecoveryService.exe, running as SYSTEM, periodically monitors the directory...

CVE-2026-14551

CVE-2026-14551 affects the servereye client (sensorhub), version 20.15 and earlier. A local privilege escalation occurs via the SE3Recovery service (EmergencyRecoveryService.exe), which runs as SYSTEM and periodically watches %ProgramData%\ServerEye3\update\ for a trigger file named update_availa...

libinput: local privilege escalation via crafted uinput devices

A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVECMD properties that are executed when a device is removed. This...

Spring Cloud Config Server - Local File Inclusion

Spring Cloud Config Server versions 2.1.x prior to 2.1.2, 2.0.x prior to 2.0.4, 1.4.x prior to 1.4.6, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files. An attacker can send a request using a specially...

Deltek Maconomy 2.2.5 - Local File Inclusion

Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.WMCS/ PATHINFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.WMCS/etc/passwd URI. id: CVE-2019-12314 info: name: Deltek Maconomy 2.2.5 - Local File Inclusion author: madrobot severity:...

Adobe Connect < 12.1.5 - Local File Disclosure

Adobe Connect versions 11.4.5 and earlier, 12.1.5 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not...

Jellyfin <10.7.0 - Local File Inclusion

Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk. id: CVE-2021-21402 info: name: Jellyfin 10.7.0 - Local File Inclusion author: dwisiswant0 severity: medium...

LimeSurvey 4.1.11 - Local File Inclusion

LimeSurvey before 4.1.12+200324 is vulnerable to local file inclusion because it contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. id: CVE-2020-11455 info: name: LimeSurvey 4.1.11 - Local File Inclusion author: daffainfo severity: critical...

Kibana - Local File Inclusion

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

CVE-2026-64023

A flaw was found in the Linux kernel's GPIO General Purpose Input/Output aggregator module. This vulnerability occurs when an error condition causes memory to be prematurely freed while still being referenced in a lookup table. A local attacker could potentially exploit this timing issue, leading...

CVE-2026-64022

A flaw was found in the Linux kernel's GPIO General Purpose Input/Output aggregator component. When the aggregator device is deactivated after being configured using configfs, a dynamic software node is not properly removed. This oversight leads to a resource leak, which could potentially be...

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

EUVD-2026-47595

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

CVE-2026-56844

The CVE concerns the Veeam Updater component within the Veeam Software Appliance. It describes a local privilege escalation that could allow a local user to gain root-level access on the underlying OS. The connected documents confirm the affected component and the impact (elevated privileges to r...

EUVD-2026-47569

Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: High...

EUVD-2026-47258

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Production...

EUVD-2026-47171

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Work in Process...

EUVD-2026-46664

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment...