34011 matches found
rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot.
A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open...
CVE-2026-12326
creationtimestamp| type| source ---|---|--- 2026-06-16 14:29:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofz3ymu6a2h 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...
MAL-2026-5885 Malicious code in wordpad-text-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d4d50aa948a360a788613f1fee19f4d1853c93d8792a5899c620e56d40c53ad On npm install, the declared postinstall hook runs node main.js, which decodes an obfuscated URL stored as...
firefox: thunderbird: Other issue in the WebRTC component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the WebRTC component...
firefox: thunderbird: Incorrect boundary conditions in the JavaScript Engine: JIT component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript Engine: JIT component...
firefox: thunderbird: Other issue in the WebRTC component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the WebRTC component...
CVE-2026-12321 JIT miscompilation in the JavaScript: WebAssembly component
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...
CVE-2026-52715
creationtimestamp| type| source ---|---|--- 2026-06-16 11:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mofnhilfdv24 2026-06-16 13:47:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofws5zfah22 2026-08-14 20:00:04+00:00| published-proof-of-concept|...
CVE-2026-39581
CVE-2026-39581 documents a SQL Injection in the WordPress plugin WP Sessions Time Monitoring Full Automatic for versions
CVE-2026-39581 WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic = 1.1.4 versions...
CVE-2026-39581 WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic = 1.1.4 versions...
Malicious code in datacamp-light (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 234a0d37873455b7db32068745d93ed29aafa596877b39949280b4ec0621ad6b datacamp-light 99.0.0 impersonates DataCamp's internal package name='datacamp-light', author='DataCamp',...
CVE-2026-42014
creationtimestamp| type| source ---|---|--- 2026-06-16 04:07:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moewdvftpp2p 2026-06-29 11:39:00+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpgfnrmckv2h 2026-06-29 11:39:01+00:00| seen|...
EUVD-2026-37010
Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable...
SNAS: A Multi-Layer Defense-In-Depth Architecture for Secure Egress in Sandboxed Workloads
Snowpark enables data engineering and AI/ML workloads in Snowflake by executing user-defined functions in secure sandboxes. Many of these workloads require external connectivity to access cloud APIs, external databases, or feature stores, creating a dependability challenge: how to provide...
PT-2026-49626
Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with module support write permission and access to a credential record can perform time-based blind SQL injection. This occurs because the expires parameter of the share generate...
Important: kernel-rt security update
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: mptcp: fix slab-use-after-free in inetlookupestablished CVE-2026-31669 kernel: xen/privcmd: fix double free via VMA splitting...
PT-2026-53068
Name of the Vulnerable Software and Affected Versions libblkid-devel versions prior to 2.42.2-1.1 Description A local privilege escalation exists in the mount8 command due to a Time-of-Check to Time-of-Use TOCTOU race condition. This flaw allows an attacker to redirect the target path during the...
PT-2026-53078
Name of the Vulnerable Software and Affected Versions openSUSE Tumbleweed versions prior to libblkid-devel-2.42.2-1.1 Description A local privilege escalation exists due to a Time-of-Check to Time-of-Use TOCTOU race condition in the mount8 utility within the hook owner.c file during chmod and cho...
