CVE-2026-66898 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...

CVE-2026-66898 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...

EUVD-2026-57540

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

CVE-2026-63293

The CVE-2026-63293 entry concerns LXD: during image import/unpack, metadata.yaml is not validated as a symlink, enabling a crafted image archive to point to host filesystem paths. This can allow arbitrary file read and write on the host, escalating to full access via symlink traversal. The descri...

CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

CVE-2026-63293

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-17029, CVE-2026-18511, CVE-2026-18068, CVE-2026-18086 in Java Secure Sockets Extension JSSE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17029 DESCRIPTION: IBM i could allow a local attacke...

CVE-2026-19642 Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version...

CVE-2026-19642

CVE-2026-19642 affects the Base64 decoder in Amazon aws-sdk-cpp prior to 1.11.862. The issue is an out-of-bounds write that could allow a remote authenticated user to crash an application or cause heap memory corruption when processing crafted Base64 input. Affected product: aws-sdk-cpp; componen...

CVE-2026-19642

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version...

CVE-2026-19642 Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version...

CVE-2026-73433 Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-73433

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-73433

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

EUVD-2026-57444

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-73433 Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-73433

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-73433

GStreamer gst-plugins-good (avidemux) contains a vulnerability in the AVI strd metadata path for FUJIFILM metadata parsing. In gst_avi_demux_parse_strd(), a remaining-length counter is decremented by fixed offsets (98 and 10 bytes) without checking data sufficiency, causing underflow for crafted ...