133 matches found
Rocky Linux 9.2 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (ciqsa-2026_1486)
The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261486 advisory. This advisory aggregates security fixes for the qemu-kvm SRPM in CIQ LTS 9.2. It addresses 5 CVEs: CVE-2023-5088, CVE-2026-48914, CVE-2025-11234,...
Rocky Linux 9.6 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (ciqsa-2026_1484)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261484 advisory. This advisory aggregates security fixes for the qemu-kvm SRPM in CIQ LTS 9.6. It addresses 8 CVEs: CVE-2026-48914, CVE-2025-11234, CVE-2026-16524,...
Rocky Linux 9.2 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (ciqsa-2026_0489)
The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260489 advisory. This advisory aggregates security fixes for the qemu-kvm SRPM in CIQ LTS 9.2. It addresses 3 CVEs: CVE-2024-3446, CVE-2024-7409, CVE-2023-2680. Tenable h...
OESA-2026-4085 qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. Th...
OESA-2026-4084 qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. Th...
...[ More ]
A proof of concept exploit for a local privilege escalation vulnerability in QEMU Guest Agent version 11.0.3. The vulnerability exists in the guest-ssh-add-authorized-keys handler, where improper handling of symbolic links allows an unprivileged guest user to redirect root-privileged file...
CVE-2026-12080
A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...
AZL-93006 CVE-2026-12080 affecting package qemu 10.1.0-1
A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...
DEBIAN-CVE-2026-12080
A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...
CVE-2026-12080
A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...
CVE-2026-12080 Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...
Linux Distros Unpatched Vulnerability : CVE-2026-12080
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by...
CVE-2026-12080: UNIX Symbolic Link (Symlink) Following
A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...
PT-2026-61584
Name of the Vulnerable Software and Affected Versions QEMU Guest Agent affected versions not specified Description A flaw exists in the QEMU Guest Agent qga within the guest-ssh-add-authorized-keys command handler. A local unprivileged user can exploit this by manipulating symbolic links through ...
SUSE CVE-2026-13318
A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...
PT-2026-52632
A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...
MiracleLinux 4 : libvirt-0.10.2-64.0.1.AXS4 (AXSA:2018-3226:03)
The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3226:03 advisory. libvirt: Resource exhaustion via qemuMonitorIORead method CVE-2018-5748 libvirt: Incomplete fix for CVE-2018-5748 triggered by QEMU guest agent...
EUVD-2020-3132
Malware in sbrugna...