CVE-2026-104809

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

CVE-2026-104809 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

CVE-2026-104809 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

Astra Linux – Vulnerability in Firefox and Thunderbird

A compromised web process was able to trigger unauthorized reads and writes in a more privileged process by using manipulated WebGL textures. This vulnerability has been fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could have sent a message to the parent process, with the contents being used to index into a JavaScript object twice. This would lead to prototype pollution, and ultimately, attacker-controlled JavaScript would execute in the privileged parent process. This vulnerability affects...

UBUNTU-CVE-2026-88924

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...

PT-2026-87106

Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101352)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101352 advisory. A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. Th...

CVE-2026-67613: Improper Limitation of a Pathname to a Restricted Directory

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

CVE-2026-20890: Improper Privilege Management

Improper privilege management for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Privileged Process may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a high complexity attack may enable escalation of privilege...

CVE-2026-70622: Improper Link Resolution Before File Access

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

sh _uid does not drop supplementary groups (incomplete privilege drop)

ImpactThe uid option performed an incomplete privilege drop on Linux/Unix-like systems.When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...

BIT-PYTHON-MIN-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module Python 3.15+ and "asyncio introspection capabilities" 3.14+, "python -m asyncio ps" and "python -m asyncio pstree" features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via t...

Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8489-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8489-1 advisory. It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag....

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview acl is a None Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. in the getfacl or setfacl process. An attacker can gain unauthorized access to files or escalate privileges by exploiting a race condition where a symbolic link replaces a...

CVE-2026-54370

acl before version 2.4.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat check and subsequent symlink-following operations such as stat, chown,...

Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected)

Summary A malicious container can crash or destabilize the privileged Inspektor Gadget process when a gadget using USDT probes is deployed. The vulnerability is in the USDT note parser pkg/uprobetracer/usdt.go which is invoked when a gadget with a SEC"usdt/..." section attaches to a target binary...

OPENSUSE-SU-2026:21146-1 Security update for lldpd

This update for lldpd fixes the following issues: Changes in lldpd: - Update to version 1.0.22 Fix CVE-2026-46433, out-of-bound read access when removing VLAN tag 787. Reject 0-length management address in LLDP. Fix race condition when creating the control socket. Fix FDP MAC address. Fix memory...

VulnCheck KEV: CVE-2025-1055

A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected ...

CVE-2026-5141

Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Hijacking a privileged process. This issue affects Pardus Software Center: from 1.0.2 before 1.0.3...