Red Hat: CVE-2026-104715: cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into moun...

PT-2026-115483

Name of the Vulnerable Software and Affected Versions cifs-utils affected versions not specified Description A flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-controlled credentials file...

PT-2026-120360

Уязвимость пакета утилит для монтирования сетевых файловых систем CIFS cifs-utils связана с внедрением или модификацией аргументов. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии и выполнить произвольный код...

Linux Distros Unpatched Vulnerability : CVE-2026-89098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify comman...

Exploit for CVE-2026-104715

CVE-2026-104715 cifs-utils credentials-file option injecti...

Malicious code in @flexmr/utils (npm)

Source: ossf-package-analysis fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4 The OpenSSF Package Analysis project identified '@flexmr/utils' @ 3.0.12 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102832 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102832 Source advisory: GHSA-JWRC-GM9J-263P...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102832 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102832 Source advisory: OSV:GHSA-JWRC-GM9J-263P...

CVE-2026-55240

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template, while the default evaluate pattern remains enabled. A workspace...

EUVD-2026-102244

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

CVE-2026-55239 Tianji: SQL Injection via unsanitized timezone parameter in analytics queries

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

CVE-2026-55239 Tianji: SQL Injection via unsanitized timezone parameter in analytics queries

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

nfs-utils: Improper exception handling leads to vulnerabilities

The nfs-utils have a vulnerability in exception handling. This vulnerability stems from the fsidd daemon process in nfs-utils improperly processing inputs received from local domain sockets. The dependent program relies on assertion validation for command parameters. Local users can send malforme...

Red Hat Enterprise Linux Resource Management Vulnerability

Red Hat Enterprise Linux versions 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform version 4, have a resource management vulnerability. This vulnerability stems from the nfs-utils’ rpc.statd service failing to properly release memory allocated during callback processing. This coul...

Astra Linux – Vulnerability in xz-utils

XZ Utils provides a general-purpose data-compression library along with command-line tools. Prior to version 5.8.3, if the lzmaindexdecoder function was used to decode an Index that contained no Records, the resulting lzmaindex would be in a state where subsequent calls to lzmaindex.Append would...

Astra Linux – Vulnerability in libraw

In LibRaw, there is a out-of-bounds read vulnerability within the “simpledecoderow” function libraw\src\x3f\x3futilspatched.cpp, which can be triggered by an image with a large rowstride field...

Malicious Package

Overview @flexmr/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

ai-parrot (>=0.5.0, <=0.5.16), aleksis-app-order (>=0.1.1, <=0.7.0.dev0) +11 more potentially affected by CVE-2026-106443 via weasyprint (61.2.0)

weasyprint PYPI version 61.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - ai-parrot =0.5.0, =0.1.1, =1.0.0, =0.1.1, =3.3.0, =0.9.8, =21.9.1, =1.0.1, =3.12.27, =2.8.0, =2.10.1 - xblock-ai-eval 0.3.3 Source cves:...

ansible-mongodb-store (>=0.1.0, <=0.3.0), bson-extra (0.0.4) +6 more potentially affected by CVE-2026-96749 via pymongo (3.12.2)

pymongo PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - ansible-mongodb-store =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.15.2, =0.1.1, =0.2.14 - ss-daily-tools 1.0.0 Source cves: CVE-2026-96749 Source advisory...

ansible-mongodb-store (>=0.1.0, <=0.3.0), bson-extra (0.0.4) +6 more potentially affected by CVE-2026-88029 via pymongo (3.12.2)

pymongo PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - ansible-mongodb-store =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.15.2, =0.1.1, =0.2.14 - ss-daily-tools 1.0.0 Source cves: CVE-2026-88029 Source advisory...