Linux Distros Unpatched Vulnerability : CVE-2026-98039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to...

SUSE CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-95627

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

CVE-2026-95627 Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

CVE-2026-95627

A vulnerability in the Tauri framework v2 dialog plugin allows an attacker with JavaScript execution (XSS) to manipulate the file or folder picker. The attacker can force the scope expansion to be recursive , granting unauthorized read/write access to an entire directory tree. This occurs after a...

CVE-2026-95627 Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

EUVD-2026-85181

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

CVE-2026-91795

Foxit PDF Editor/Reader is affected by a vulnerability in its FileOpen plugin because it fails to adequately validate certain encryption metadata in specially crafted PDF files. This lack of validation can leave an internal pointer in an invalid state, resulting in chained read and write access v...

Moderate: Red Hat Security Advisory: gstreamer1-plugins-good security update

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Moderate. A...

MAL-2026-16433 Malicious code in @vitemirrorte/element-plus-vite-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d616b037ed0b4ebbb3a3ddf36963379ea00d4b5f8513641db05e7773dd2696c9 On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materiali...

Malicious code in @vitemirrorte/element-plus-vite-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d616b037ed0b4ebbb3a3ddf36963379ea00d4b5f8513641db05e7773dd2696c9 On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materiali...

CVE-2026-95627: Incorrect Permission Assignment for Critical Resource

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

PT-2026-97262

Name of the Vulnerable Software and Affected Versions Tauri affected versions not specified Description An attacker with JavaScript execution capabilities, such as through Cross-Site Scripting XSS, can manipulate the dialog plugin's file or folder picker. This allows the attacker to force a...

CVE-2026-95814

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

SUSE CVE-2026-91142

A flaw was found in Cockpit. An authenticated local user with a large user identifier UID can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entri...

CVE-2026-77243: Missing Authorization

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...

Moderate: Red Hat Security Advisory: gstreamer1-plugins-good security update

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common...

gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

PT-2026-96264

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.6-lts Description Function-library code running under the LD PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback. This allows the dlopen call-stack heuristic to identify a Python...

EulerOS Virtualization 2.10.0 : perl-Archive-Tar (EulerOS-SA-2026-3879)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction...