CVE-2026-101281: Improper Authentication

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcsp2findmailfromdomain of the file libopendmarc/opendmarcspf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible...

PT-2026-102418

Name of the Vulnerable Software and Affected Versions OpenDMARC versions prior to 1.4.3 Description A flaw in the SPF Macro Handler component allows for improper authentication via remote manipulation. The issue resides in the opendmarc sp2 find mailfrom domain function within the...

SUSE CVE-2026-95519

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

Linux Distros Unpatched Vulnerability : CVE-2026-95519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar...

CVE-2026-97359

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

CVE-2026-97360

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...

CVE-2026-95519

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

AZL-105329 CVE-2026-95519 affecting package rpm 4.18.2-2

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

DEBIAN-CVE-2026-95519

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

DEBIAN-CVE-2026-95521

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

AZL-105326 CVE-2026-95521 affecting package rpm 4.18.2-2

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-97360 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...

EUVD-2026-85880

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...

CVE-2026-97360 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...

CVE-2026-97360

HFS2 version 2.4.0 and earlier is vulnerable to an unauthenticated arbitrary file access flaw. The root cause is the macro dispatcher's lack of an authorization model combined with a path resolver that fails to confine absolute paths. Attackers can exploit this to manipulate the template engine ,...

CVE-2026-95521 Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-95521

A command injection flaw exists in rpm when installing or rebuilding a source RPM . If the source or spec file basenames contain a %() macro construct , rpm executes attacker-controlled shell commands via popen() during the relocation of the source file list. This vulnerability allows for arbitra...

CVE-2026-95521 Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-95519

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

CVE-2026-95519

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using "rpm -q -p" or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...