CVE-2026-93353: Improper Link Resolution Before File Access

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The mkdir, rmdir, and...

PT-2026-98301

Name of the Vulnerable Software and Affected Versions copyparty affected versions not specified Description The SFTP front end contains a volume restriction bypass that allows authenticated users to create, remove, and truncate arbitrary paths outside permitted volume boundaries. This occurs...

FreeBSD : podman -- vulnerabilities (050e54b4-b81e-11f1-b540-589cfc10a551)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 050e54b4-b81e-11f1-b540-589cfc10a551 advisory. The Podman developers report: This release addresses CVE-2025-11395, where importing images...

automation-controller: automation-controller-container: automation-controller: container group pod_spec_override mints the automation-controller ServiceAccount token and mounts control-plane namespace secrets into job pods, bypassing automountServiceAccountToken:false (control-plane secret and identity compromise)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. A user with the delegated Instance Group Admin role on a container group can set a free-form pod specification override that is deep-merged, without filtering, into every job pod launched on that group. The only...

AZL-105128 CVE-2026-88832 affecting package busybox 1.36.1-27

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

DEBIAN-CVE-2026-88832

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

CVE-2026-88832 Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

PT-2026-97417

Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description A heap buffer overflow occurs during romfs volume ID parsing when processing crafted filesystem images. The issue stems from the use of unbounded strlen and memcpy operations on...

CVE-2026-88832: Out-of-bounds Write

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

podman: podman: Quadlet install --replace non-truncating write retains removed host-access directives

The 'podman quadlet install --replace' command opens the existing destination file with OCREATE|OWRONLY but omits OTRUNC. When the initial reflink copy attempt fails common on non-reflink-capable filesystems including many RHEL default XFS configurations, the fallback in ReflinkOrCopy uses io.Cop...

Linux Distros Unpatched Vulnerability : CVE-2026-93987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the newVolume process in the Docker volume plugin when the name field of a VolumeDriver.Create request is not properly validated. An attacker can cause the creation and mounting of a remote...

UBUNTU-CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

CVE-2026-93987 rclone serve docker Path Traversal via Volume Name

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

PT-2026-95824

Name of the Vulnerable Software and Affected Versions rclone versions 1.56.0 through 1.75.0 Description A path traversal issue exists in the rclone serve docker volume plugin. The newVolume function in cmd/serve/docker/volume.go calculates a volume mountpoint using the name variable from a Docker...

Linux Distros Unpatched Vulnerability : CVE-2026-90196

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It...

AZL-102272 CVE-2026-90196 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

DEBIAN-CVE-2026-90196

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

CVE-2026-90196

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

CVE-2026-90196 ASoC: SOF: validate topology volume range before allocation

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...