CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

Amazon Linux 2 : microcode_ctl, --advisory ALAS2-2026-3294 (ALAS-2026-3294)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3294 advisory. Improper handling of values in the microcode flow for some IntelR Processor Family may allow an escalation of privilege. Startu...

Important: dotnet10.0

Issue Overview: Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. CVE-2026-40372 Affected Packages: dotnet10.0 Issue Correction: Run dnf update dotnet10.0 --releasever 2023.11.20260427 or dnf update --advisory...

EUVD-2026-24052

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's Helper::stripDangerousTags removes , , , but does NOT strip tags. The mailbox signature field is saved via POST /mailbox/settings/id and later rendered unescaped via !!...

CVE-2026-4878

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the capsetfile function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so,...

Mozilla Thunderbird < 140.9

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-24 advisory. - Privilege escalation in the Netmonitor component. This vulnerability affects Firefox 149, Firefox ESR...

MGASA-2026-0052 Updated rootcerts, nss & firefox packages fix security vulnerabilities

Incorrect boundary conditions in the WebRTC: Audio/Video component. CVE-2026-2757 Use-after-free in the JavaScript: GC component. CVE-2026-2758 Incorrect boundary conditions in the Graphics: ImageLib component. CVE-2026-2759 Sandbox escape due to incorrect boundary conditions in the Graphics:...

ASB-A-459479964

In multiple functions of memprotect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001447)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001447 advisory. In bpfskbchangehead of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System executi...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002467)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002467 advisory. Off-by-one error in the bpfjitcompile function in arch/x86/net/bpfjitcomp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003061)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003061 advisory. An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xenfailsafecallback entry point in arch/x86/entry/entry64.S does not...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003332)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003332 advisory. Race condition in the ioctlfilededuperange function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service heap-based buffer...

rustfs 安全漏洞

rustfs is a high-performance object storage system from the RustFS open source. A security vulnerability exists in rustfs versions 1.0.0-alpha.13 through 1.0.0-alpha.78, which stems from a flaw in the denyonly short-circuit logic that could lead to elevation of privilege and bypassing session...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2025-67722 Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation

FreePBX is an open-source web-based graphical user interface GUI that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script amportal. In the deprecated amportal utility, the...

CVE-2025-33190

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware where an attacker could cause an out-of-bound write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, or escalation of privileges...

EulerOS 2.0 SP13 : pam (EulerOS-SA-2025-2273)

According to the versions of the pam packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local users to elevat...

EUVD-2024-54966

Malicious code in bioql PyPI...

CVE-2025-1131 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation

A local privilege escalation vulnerability exists in the safeasterisk script included with the Asterisk toolkit package. When Asterisk is started via this script common in SysV init or FreePBX environments, it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating...

CVE-2024-44893

The vulnerability CVE-2024-44893 affects JimuReport v1.7.8, specifically the component path /jeecg-boot/jmreport/dict/list. A crafted GET request can allow an attacker to escalate privileges. The CVE is rated CVSSv3.1 base score 9.8 (CRITICAL) with NETWORK attack vector, no user interaction requi...