CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

CVE-2026-88014: Improper Limitation of a Pathname to a Restricted Directory

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

PT-2026-89475

Name of the Vulnerable Software and Affected Versions rclone versions 1.72.0 through 1.75.0 Description The archive ZIP backend in rclone is susceptible to a Zip Slip path traversal issue. The Fs.readZip function in backend/archive/zip/zip.go processes file names from an untrusted ZIP central...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-87014

Open WebUI (self-hosted AI platform) versions 0.9.0 through 0.11.1 contain a privilege-escalation issue in its role synchronization logic. The files backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's database role without invalidating the user rec...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

Security update for hauler (moderate)

openSUSE security update: security update for hauler ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21793-1 Rating: moderate References: bsc1265425 bsc1276124 bsc1276651 bsc1277965 Cross-References: CVE-2026-37236 CVE-2026-41178 CVE-2026-41888...

Linux Distros Unpatched Vulnerability : CVE-2026-80903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053201)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053201 advisory. In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync: don't enable IRQ from syncprintobj Since commit a6aa8fca4d79 dma-buf/sw-sync:...

SUSE CVE-2026-80903

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails before the point of no return fence allocation, config buffer...

CVE-2026-80903

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails before the point of no return fence allocation, config buffer...

CVE-2026-80903 drm/xe/oa: Fix sync entry leak on OA config emit failure

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails before the point of no return fence allocation, config buffer...

CVE-2026-80903 drm/xe/oa: Fix sync entry leak on OA config emit failure

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails before the point of no return fence allocation, config buffer...

CVE-2026-80903

CVE-2026-80903 affects the Linux kernel's drm/xe/oa component (Intel Xe graphics driver, Open Animation subsystem). The root cause is a memory leak : xe_oa_emit_oa_config() releases sync entries and the syncs array only on its success path. When it fails before the point of no return (fence alloc...

EUVD-2026-71662

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails before the point of no return fence allocation, config buffer...

CVE-2026-80903

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails before the point of no return fence allocation, config buffer...

CVE-2026-85669

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85622

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establishwsconnectionv2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object...

EUVD-2026-71125

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85669 potpie through 2.0.0 Missing Ownership Check via code-changes sync

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...