14988 matches found
f2fs DoS
The vulnerability of the f2fs component of the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-18749
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
CVE-2026-18749 CVE-2026-18749
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
CVE-2026-18749
A vulnerability exists in the VinceTrack system where the type=track branch incorrectly authorizes access based only on _is_my_case(t_attach.case) without checking the VinceTrackAttachment.shared status. This flaw allows any case member who possesses or is sent the UUID of a coordinator-uploaded ...
undici: undici: Cross-user cookie disclosure via Set-Cookie caching
A flaw was found in undici. The software's caching mechanism, when operating in shared cache mode, improperly stores responses that include 'Set-Cookie' headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one...
CVE-2026-18171 Docker Sandboxes read-only runtime mount writable through its shared-export alias
Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...
CVE-2026-73263 Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path
Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec...
CVE-2026-73263
Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec...
undici: undici: Cross-user cookie disclosure via Set-Cookie caching
A flaw was found in undici. The software's caching mechanism, when operating in shared cache mode, improperly stores responses that include 'Set-Cookie' headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one...
No title provided
A flaw was found in AMD Zen 2-based processors, affecting components such as the kernel and Xen hypervisor. Improper isolation of shared resources within the CPU operation cache could allow an attacker to corrupt instructions executed at a different privilege level. This could potentially result ...
Debian dla-4735 : neutron-api - security update
The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4735 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4735-1 [email protected] https://www.debian.org/lts/security/...
CVE-2026-73263: Improper Neutralization of Special Elements used in an OS Command
Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec...
ksmbd DoS
The vulnerability of the ksmbd component in the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause service failures...
Linux kernel/futex Confidential Data Access
The vulnerability of the kernel/futex component of the Linux operating system’s kernel is related to insufficient checking of the state of the shared resource. Exploiting this vulnerability can allow an attacker to gain access to confidential data...
FreeBSD Largepage Privilege Escalation
The vulnerability of the implementation of shared memory objects in FreeBSD’s large-page cores relates to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to enhance their privileges...
FreeBSD Largepage Privilege Escalation
The vulnerability of the implementation of shared memory objects in FreeBSD’s large-page cores is related to insufficient checking of input data. Exploiting this vulnerability can allow an attacker to enhance their privileges...
Linux driver scsi smartpqi_init Heap Buffer Overflow DoS
The vulnerability in the drivers/scsi/smartpqi/smartpqiinit.c component of the Linux operating system’s kernel is related to insufficient checking of the status of a shared resource. Exploiting this vulnerability can allow an attacker to cause service failures...
Unchecked Return Value
Overview Affected versions of this package are vulnerable to Unchecked Return Value due to improper access control in the diagnostics IPC. An attacker can gain elevated privileges by exploiting a missing error check that results in incorrect access control lists being applied to shared resources...
