CVE-2026-112909

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

EUVD-2026-102205

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Convert inline data to extents when truncate exceeds inline size A check has been added to ext4setattr to convert files from inline data storage to extent-based storage when the truncate function increases the file size...

CVE-2026-110458

The UniFi Protect AI Key is vulnerable to a Path Traversal vulnerability (CWE-22) that could be exploited by a malicious actor with network access. Under specific conditions, this flaw allows an attacker to create or truncate files on the device. No specific remediation or exploit details are pro...

ogmios-queryledgerstate-dump-poc

Ogmios queryLedgerState/dump — Unauthenticated Arbitrary Fil...

EulerOS 2.0 SP13 : python-filelock (EulerOS-SA-2026-4093)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

EulerOS 2.0 SP11 : python-filelock (EulerOS-SA-2026-4366)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

EulerOS 2.0 SP13 : python-filelock (EulerOS-SA-2026-4184)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

CVE-2026-108839: Improper Link Resolution Before File Access

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Do not hold the nilock lock when calling truncatesetsize. syzbot reports a hung task during the call to douseraddrfault 1. This occurs because there is a silent deadlock between the PGlocked bit and the nilock lock. Sin...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: block: Fixed an incorrect offset in biotruncate The biotruncate function clears the buffer outside of the last block of bdev. However, the current implementation of biotruncate uses the wrong offset for the page. As a result, it...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the chars and words methods from django.utils.text.Truncator when used with html=True are susceptible to a potential DoS denial of service attack due to certain inputs containing very long, potentially malformed HTML text. The...

Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/openOTRUNC. CVE-2026-52791 Operations on hardlinked lower-layer files resolving to the wrong layer. CVE-2026-77478...

MGASA-2026-0462 Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/openOTRUNC. CVE-2026-52791 Operations on hardlinked lower-layer files resolving to the wrong layer. CVE-2026-77478...

SUSE CVE-2026-93235

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

DEBIAN-CVE-2026-93235

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

CVE-2026-93235

The Linux kernel f2fs filesystem contains a vulnerability where extending a file size across an unaligned EOF boundary (via truncate , fallocate , or write ) could fail to zero out post-EOF data in the partial page. This flaw could expose stale disk data after a remount or crash recovery. The fix...

CVE-2026-93235 f2fs: fix to zero post-EOF data when extending file size

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

PT-2026-97902

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs filesystem where extending a file size across an unaligned EOF End of File boundary—via operations such as truncate, fallocate, or write—may fail to properly...

CVE-2026-54767

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletarsocios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chavecorreta value embedded in the public source repository. A remote attacker...