CVE-2026-108833: Undefined Security Weakness

Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

containerd: Unpack DoS via repeated opaque whiteouts

Impact A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers causes superlinear time complexity. During the unpack operation, specific file configurations within the layer can trigger repeated directory traversals. Consequently, pulling or...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: Watchdog: Fixed a possible use-after-free in wdtstartup. The remove path of this module calls deltimer. However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running...

CVE-2026-107349

A flaw was found in PgBouncer. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a startup message that contains an empty parameter name in its options. This causes PgBouncer to enter an infinite loop during startup parameter processing, consuming high CPU resources...

mariadb: mariadb: Arbitrary code execution via insecure service account home directory

A flaw was found in MariaDB. The dedicated database service account was configured using the database data directory as its home directory. An authenticated database user with file-writing privileges could place malicious startup scripts into this directory. This could result in arbitrary code...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the applyNaive function in pkg/archive/tar.go, where each .wh..wh..opq entry triggers a full filepath.Walk of the containing directory with no record of directories already process...

CVE-2026-107814

A flaw was found in MariaDB. The dedicated database service account was configured using the database data directory as its home directory. An authenticated database user with file-writing privileges could place malicious startup scripts into this directory. This could result in arbitrary code...

UBUNTU-CVE-2026-107814

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

CVE-2026-107814

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

CVE-2026-107785: Unexpected Status Code or Return Value

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this size; instead it attempts to use the wg s...

EUVD-2026-44646

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification...

AZL-106170 CVE-2026-98195 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

Zyxel Firewall Auth Bypass (CVE-2022-0342)

Exploits CVE-2022-0342 in Zyxel USG/ZyWALL/ATP/VPN/NSG: unauthenticated export-cgi downloads startup-config.conf with admin credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel firewall export-cgi auth bypass CVE-2022-0342.""" from kittysploit import from lib.protocols.http.httpclient...

WinRAR Path Traversal (CVE-2025-8088)

Generates a malicious RAR archive exploiting CVE-2025-8088 path traversal in WinRAR = 7.11. When extracted, payload is written to the Windows Startup folder for code execution on next login. User interaction required. !/usr/bin/env python3 -- coding: utf-8 -- """WinRAR path traversal code executi...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed the startup race issue with nsfd again. The commit bd5ae9288d64 "nfsd: register pernet ops last, unregister first" re-opened the race in rpcpipefsevent, which was related to the registration of nfsdnetid using...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Ensure that the traceprintk function can be used as soon as it is available. Currently, the traceprintk function can be used as soon as the earlyTraceinit function is called from startkernel. However, if a crash occurs,...

CVE-2026-104019

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might...

EUVD-2026-91795

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might...

CVE-2026-104019

An OS command injection vulnerability exists in the Studio Space startup validation script of Amazon SageMaker Distribution (versions 2.x < 2.14.12, 3.x < 3.9.12, 4.0.x < 4.0.11, 4.1.x < 4.1.11, 4.2.x < 4.2.8, 4.3.x < 4.3.5, and 4.4.x

CVE-2026-104019: Improper Neutralization of Special Elements used in an OS Command

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might...