3558 matches found
EUVD-2026-52336
A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...
CVE-2026-18477
CVE-2026-18477 describes a TOCTOU flaw in GNU tar related to incremental dumpdir rename handling. A local attacker with write access to a directory being backed up can influence the restore process on the target system, causing files/directories to be created, renamed, or overwritten outside the ...
CVE-2026-18477 Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape
A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...
CVE-2026-18477 Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape
A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...
TencentOS Server 4: redis (TSSA-2026:0773)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0773 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
HP LaserJet Printers Classic Buffer Overflow (CVE-2023-35176)
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through the embedded web service on the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot fo...
tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape
A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...
SUSE CVE-2026-66373
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK pending entry is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free...
Preserving Restored InterSystems IRIS Data Before Removing a Storage System
Article Applicability This article expands on the following note from Epic EHR System Protection Restoring from Storage Snapshot in the Veeam Backup & Replication User Guide: Before you start the restore wizard, create an auxiliary host for the LUN mount in the storage system interface, using any...
kernel: ipc: limit next_id allocation to the valid ID range
A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...
CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers
The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...
EUVD-2026-51563
The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...
kernel: ipc: limit next_id allocation to the valid ID range
A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...
CVE-2026-18436
The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign//restore-revision/. The route in the vulnerable range was registered without a permissionCallback,...
kernel: ipc: limit next_id allocation to the valid ID range
A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...
EUVD-2026-51507
The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign//restore-revision/. The route in the vulnerable range was registered without a permissionCallback,...
CVE-2026-18436
The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign//restore-revision/. The route in the vulnerable range was registered without a permissionCallback,...
CVE-2026-18436 MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign//restore-revision/. The route in the vulnerable range was registered without a permissionCallback,...
CVE-2026-18436
MailerPress for WordPress <= 1.5.0 exposes a missing authorization check on the campaign revision-restore REST endpoint (POST /wp-json/mailpress/v1/campaign//restore-revision/). The vulnerable route allowed the restoreRevision() handler to run for unauthenticated users, enabling modification o...
Redis < 8.8.0 RCE via RESTORE Double Free (CVE-2026-66373)
The version of Redis installed on the remote host is prior to 8.8.0. It is, therefore, affected by a remote code execution vulnerability. - Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the sam...