121044 matches found
CVE-2026-68100 ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...
CVE-2026-68099 ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on checkaddoverflow to avoid malformed ACL checkaddoverflow unconditionally writes the truncated sum into d even on overflow, per its contract in include/linux/overflow.h. The four checkaddoverflow guards...
CVE-2026-68098 ksmbd: bound DACL dedup walk to copied ACEs
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...
CVE-2026-68098
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...
CVE-2026-68097
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...
Security update for perl
This update for perl fixes the following issues: CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds bsc1266304. CVE-2026-12087: Socket's packipmreqsource can copy adjacent heap memory into the returned packed structure bsc1268349...
CVE-2026-72593
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem...
CVE-2026-72571
A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...
CVE-2026-72568
Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...
DEBIAN-CVE-2026-72568
An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...
DEBIAN-CVE-2026-71391
GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...
CVE-2026-72565
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...
UBUNTU-CVE-2026-72568
An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...
CVE-2026-72568
Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...
CVE-2026-72593 dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem...
EUVD-2026-55234
A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...
CVE-2026-72571 mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter
A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...
CVE-2026-72571
A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...
CVE-2026-72571
The CVE-2026-72571 entry concerns mustafaakin/cast-localvideo (all versions). A path traversal vulnerability exists where app.js reads req.body.dir and passes it to res.sendFile() without sanitization (lines 151–153), enabling an unauthenticated remote attacker to read arbitrary server files via ...
