PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability

A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root...

Cisco ISE - Remote Code Execution

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to...

Security Bulletin: This Power System update is being released to address CVE-2026-17063

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions,...

Security Bulletin: This Power System update is being released to address CVE-2026-17097

Summary Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL ...

Security Bulletin: This Power System update is being released to address CVE-2026-17091

Summary Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a...

MINI-WHR8-9P5R-2FFH

Bulletin has no description...

GHSA-25QR-6MPR-F7QX vulnerabilities

Vulnerabilities for packages: telegraf...

GO-2020-0012 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2022-0391 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2024-3169 vulnerabilities

Vulnerabilities for packages: buildah...

GO-2026-5757 vulnerabilities

Vulnerabilities for packages: minio...

GO-2022-0895 vulnerabilities

Vulnerabilities for packages: k3d...

EUVD-2026-58548

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...

CVE-2026-0295

The provided data identifies CVE-2026-0295 as a race condition in the Palo Alto Networks GlobalProtect client on macOS, allowing a locally authenticated low-privileged attacker to escalate to root. Affected: GlobalProtect macOS client. Not affected: GlobalProtect apps on Linux, Windows, iOS, Andr...

EUVD-2026-57709

A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected...

CVE-2026-0295 GlobalProtect App: Local Privilege Escalation via Race Condition on macOS

A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected...

CVE-2026-73519

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

GHSA-RP2P-6CMP-JXJ9 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

UBUNTU-CVE-2026-63294

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can...

EUVD-2026-57414

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user including one holding only low-privilege, read-only permissions to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the conte...