PT-2026-34505

Name of the Vulnerable Software and Affected Versions uutils coreutils affected versions not specified Description An argument parsing error in the kill utility incorrectly interprets the command 'kill -1' as a request to send the default signal SIGTERM to PID -1. Sending a signal to PID -1 cause...

CVE-2026-35379: Incorrect Provision of Specified Functionality

A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the :graph: and :print: character classes. The implementation mistakenly includes the ASCII space character 0x20 in the :graph: class and excludes it from the :print: class, effectively reversing the...

PT-2026-34506

Name of the Vulnerable Software and Affected Versions uutils coreutils affected versions not specified Description The id utility miscalculates the groups= section of its output by using a user's real GID instead of their effective GID to compute the group list. This creates a discrepancy compare...

CVE-2026-35370: Incorrect Authorization

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes...

CVE-2026-35377: Improper Input Validation

A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S split-string option. In GNU env, backslashes within single quotes are treated literally with the exceptions of \ and '. However, the uutils implementation...

CVE-2026-35355: Time-of-check Time-of-use (TOCTOU) Race Condition

The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use TOCTOU race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the OEXCL flag. A local attacker can exploit t...

PT-2026-43130

Name of the Vulnerable Software and Affected Versions GNU LibreDWG versions prior to 0.15 Description A heap-based buffer overflow exists in the Dwgread Utility component within the decompress R2004 section function of the src/decode.c file. This issue occurs during the processing of DWG format...

Linux Distros Unpatched Vulnerability : CVE-2026-35364

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Time-of-Check to Time-of-Use TOCTOU race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the...

Linux Distros Unpatched Vulnerability : CVE-2026-35374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Time-of-Check to Time-of-Use TOCTOU vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking for...

Linux Distros Unpatched Vulnerability : CVE-2026-35378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the...

Linux Distros Unpatched Vulnerability : CVE-2026-35360

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use TOCTOU race condition during file creation. When the utility identifies a...

Linux Distros Unpatched Vulnerability : CVE-2026-35350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p preserve flag, th...

Linux Distros Unpatched Vulnerability : CVE-2026-35380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' two single quotes as an empty...

Linux Distros Unpatched Vulnerability : CVE-2026-35357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived...

CVE-2026-35380: Improper Input Validation

A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' two single quotes as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d delimiter and --output-delimiter options. Th...

PT-2026-34507

Name of the Vulnerable Software and Affected Versions uutils coreutils affected versions not specified Description The id utility exhibits incorrect behavior in its pretty print output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the...

Linux Distros Unpatched Vulnerability : CVE-2026-35351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a...

Linux Distros Unpatched Vulnerability : CVE-2026-35379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the :graph: and :print: character classes. The implementation...

Linux Distros Unpatched Vulnerability : CVE-2026-35343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The cut utility in uutils coreutils incorrectly handles the -s only-delimited option when a newline character is specified as the delimiter. The implementation...

Linux Distros Unpatched Vulnerability : CVE-2026-35377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S split-string option. In GN...