CVE-2026-48855 SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix. An...

CVE-2026-44933

CVE-2026-44933 affects the libzypp component’s PluginScript during plugin loading. The vulnerability arises when a plugin is chrooted to repoManagerRoot; if the target is “/” (which is common in standard configurations or when using --root), the chroot becomes a no-op, but the traversed path can ...

USN-2420-1 linux vulnerabilities

A flaw was discovered in how the Linux kernel's KVM Kernel Virtual Machine subsystem handles the CR4 control register at VM entry on Intel processors. A local host OS user can exploit this to cause a denial of service kill arbitrary processes, or system disruption by leveraging /dev/kvm access...