63 matches found
Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch
Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vulnerability caused by inconsistent authorization checks in the repository-creation UI, letting delegated repository-admin users create unauthorized repository formats, exploit requires delegated repository-admin...
CVE-2026-72052
A flaw was found in the Linux kernel's ip6gre and ip6erspan tunnel drivers. The changelink functions in these drivers do not adequately verify administrative capabilities CAPNETADMIN across different network namespaces. This allows a local attacker, who has CAPNETADMIN in one network namespace bu...
EUVD-2026-59507
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches. This is enforced by checkmapprogcompatibility when the map is referenc...
CVE-2026-10682
The CVE-2026-10682 entry describes an OOB read and subsequent memory-write in Zephyr’s log_filter_set syscall verifier due to a signed comparison: src_id < (int16_t)log_src_cnt_get(domain_id). Negative src_id values (e.g., -1) pass the check after sign-extension and are used as an unsigned ind...
Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-8529-1)
"The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8529-1 advisory. It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is kno...
CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
Amazon Linux 2 : microcode_ctl, --advisory ALAS2-2026-3294 (ALAS-2026-3294)
The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3294 advisory. Improper handling of values in the microcode flow for some IntelR Processor Family may allow an escalation of privilege. Startu...
Important: dotnet10.0
Issue Overview: Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. CVE-2026-40372 Affected Packages: dotnet10.0 Issue Correction: Run dnf update dotnet10.0 --releasever 2023.11.20260427 or dnf update --advisory...
EUVD-2026-24052
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's Helper::stripDangerousTags removes , , , but does NOT strip tags. The mailbox signature field is saved via POST /mailbox/settings/id and later rendered unescaped via !!...
CVE-2026-4878
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the capsetfile function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so,...
Mozilla Thunderbird < 140.9
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-24 advisory. - Privilege escalation in the Netmonitor component. This vulnerability affects Firefox 149, Firefox ESR...
MGASA-2026-0052 Updated rootcerts, nss & firefox packages fix security vulnerabilities
Incorrect boundary conditions in the WebRTC: Audio/Video component. CVE-2026-2757 Use-after-free in the JavaScript: GC component. CVE-2026-2758 Incorrect boundary conditions in the Graphics: ImageLib component. CVE-2026-2759 Sandbox escape due to incorrect boundary conditions in the Graphics:...
ASB-A-459479964
In multiple functions of memprotect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001447)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001447 advisory. In bpfskbchangehead of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System executi...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003061)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003061 advisory. An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xenfailsafecallback entry point in arch/x86/entry/entry64.S does not...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003332)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003332 advisory. Race condition in the ioctlfilededuperange function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service heap-based buffer...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002467)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002467 advisory. Off-by-one error in the bpfjitcompile function in arch/x86/net/bpfjitcomp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a...
rustfs 安全漏洞
rustfs is a high-performance object storage system from the RustFS open source. A security vulnerability exists in rustfs versions 1.0.0-alpha.13 through 1.0.0-alpha.78, which stems from a flaw in the denyonly short-circuit logic that could lead to elevation of privilege and bypassing session...
Important: Red Hat Security Advisory: thunderbird security update
An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2025-67722 Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation
FreePBX is an open-source web-based graphical user interface GUI that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script amportal. In the deprecated amportal utility, the...