RustFS Path Traversal Vulnerability

RustFS Path Traversal Vulnerability Vulnerability Details - CVE ID: - Severity: Critical CVSS estimated 9.9 - Impact: Arbitrary File Read/Write - Component: /rustfs/rpc/readfilestream endpoint - Root Cause: Insufficient path validation in crates/ecstore/src/disk/local.rs:1791 Vulnerable Code rust...

Rust path traversal vulnerability

rustfs is a high-performance object storage system in the RustFS open source. A path traversal vulnerability exists in rustfs versions 1.0.0-alpha.13 through 1.0.0-alpha.78, which stems from a path traversal in the /rustfs/rpc/readfilestream endpoint...

PT-2026-1916

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.13 through 1.0.0-alpha.78 Description RustFS is a distributed object storage system built in Rust. Versions 1.0.0-alpha.13 through 1.0.0-alpha.78 contain a path traversal vulnerability in the /rustfs/rpc/read file...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000339)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000339 advisory. In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the sctpsendmsg function net/sctp/socket.c when handling SCTPSENDALL flag can be...

curl: State Isolation Failure in Multiplexed Connections (Shared Auth Context)

Vulnerability: State Isolation Failure in Multiplexed Connections Shared Auth Context Product: libcurl Affected Versions: v7.43.0 - Current v8.x - All versions supporting HTTP/2 Multiplexing Severity: CRITICAL CVSS: 9.1 1. Executive Summary A fundamental design flaw exists in libcurl's state...

ALPRs are recording your daily drive (Lock and Code S06E26)

This week on the Lock and Code podcast … There's an entire surveillance network popping up across the United States that has likely already captured your information, all for the non-suspicion of driving a car. Automated License Plate Readers, or ALPRs, are AI-powered cameras that scan and store ...

PT-2026-2932

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.20.1 Description A heap-buffer-overflow can occur in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound. This allows an oversized re...

PT-2026-4483

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to handling of msg get inq within the networking subsystem. The issue involves a potential NULL pointer dereference when writing to msg get inq ...

PT-2026-3761

Name of the Vulnerable Software and Affected Versions glib affected versions not specified Description A flaw exists in glib due to missing validation of offset and count parameters within the g buffered input stream peek function. This can result in an integer overflow during length calculation...

PT-2026-26191

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.9.1 Description pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to create a malicious PDF that can cause prolonged runtimes and/or significant memory usage...

PT-2026-8118

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.0 Description A null pointer dereference issue was identified in the SCTP transmit path during SCTP-AUTH key initialization. This occurs when processing an INIT ACK, specifically if sctp auth asoc init active...

CVE-2022-50861

In the Linux kernel, the following vulnerability has been resolved: NFSD: Finish converting the NFSv2 GETACL result encoder The xdrstream conversion inadvertently left some code that set the pagelen of the send buffer. The XDR stream encoders should handle this automatically now. This oversight...

EUVD-2022-55936

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated vulnerability that allows remote attackers to access live radio stream information through webplay or ffmpeg scripts. Attackers can exploit the vulnerability by calling specific web scripts to disclose radio stream...

SUSE CVE-2022-50861

In the Linux kernel, the following vulnerability has been resolved: NFSD: Finish converting the NFSv2 GETACL result encoder The xdrstream conversion inadvertently left some code that set the pagelen of the send buffer. The XDR stream encoders should handle this automatically now. This oversight...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993257)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993257 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: clean up skbs if ath9khifusbrxstream fails Syzkaller detected a memory leak ...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992824)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992824 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Fix data races in unixreleasesock/unixstreamsendmsg A data-race condition has been...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993168)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993168 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: clear outcurr if all frag chunks of current msg are pruned A crash was reported by Zhen Che...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992715)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992715 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check stream before comparing them WHAT & HOW amdgpudm can pass a null stream to...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992863)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992863 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpudm initialize when stream nums greater than 6 Why Coverity reports...

CVE-2024-58336

Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endpoint on port 8080. Attackers can retrieve video stream data without authentication by directly accessing the specified endpoint on affecte...