Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,899 results · page 8 of 58
Apr 22, 2026A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option.CVE-2026-35368 · Other software · Uutils · reported by security@ubuntu.comHigh 7.8
A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions.CVE-2026-35367 · Other software · Uutils · reported by security@ubuntu.comLow 3.3
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences.CVE-2026-35366 · Other software · Uutils · reported by security@ubuntu.comMedium 4.4
The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries.CVE-2026-35365 · Other software · Uutils · reported by security@ubuntu.comMedium 6.6
The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preserving symlinks, the implementation expands them, copying the linked targets as real files or directories at the destination. This can lead to resource exhaustion (disk space or time) if symlinks point to large external directories, unexpected duplication of sensitive data into unintended locations, or infinite recursion and repeated copying in the presence of symlink loops.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations.CVE-2026-35364 · Other software · Uutils · reported by security@ubuntu.comMedium 6.3
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory.CVE-2026-35363 · Other software · Uutils · reported by security@ubuntu.comMedium 5.6
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relatCVE-2026-35362 · Other software · Uutils · reported by security@ubuntu.comLow 3.6
The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context.CVE-2026-35361 · Other software · Uutils · reported by security@ubuntu.comLow 3.4
The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation.CVE-2026-35360 · Other software · Uutils · reported by security@ubuntu.comMedium 6.3
The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent.CVE-2026-35359 · Other software · Uutils · reported by security@ubuntu.comMedium 4.7
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preCVE-2026-35358 · Other software · Uutils · reported by security@ubuntu.comMedium 4.4
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The cp utility in uutils coreutils is vulnerable to an information disclosure race condition.CVE-2026-35357 · Other software · Uutils · reported by security@ubuntu.comMedium 4.7
The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag.CVE-2026-35356 · Other software · Uutils · reported by security@ubuntu.comMedium 6.3
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation.CVE-2026-35355 · Other software · Uutils · reported by security@ubuntu.comMedium 6.3
The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves.CVE-2026-35354 · Other software · Uutils · reported by security@ubuntu.comMedium 4.7
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0CVE-2026-35353 · Other software · Uutils · reported by security@ubuntu.comLow 3.3
The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils.CVE-2026-35352 · Other software · Uutils · reported by security@ubuntu.comHigh 7
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Apr 22, 2026The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries.CVE-2026-35351 · Other software · Uutils · reported by security@ubuntu.comMedium 4.2
The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails.CVE-2026-35350 · Other software · Uutils · reported by security@ubuntu.comMedium 6.6
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection.CVE-2026-35349 · Other software · Uutils · reported by security@ubuntu.comMedium 6.7
A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames.CVE-2026-35348 · Other software · Uutils · reported by security@ubuntu.comMedium 5.5
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations.CVE-2026-35347 · Other software · Uutils · reported by security@ubuntu.comMedium 4.4
The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines.CVE-2026-35346 · Other software · Uutils · reported by security@ubuntu.comLow 3.3
The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option.CVE-2026-35345 · Other software · Uutils · reported by security@ubuntu.comMedium 5.3
A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts.CVE-2026-35344 · Other software · Uutils · reported by security@ubuntu.comLow 3.3
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter.CVE-2026-35343 · Other software · Uutils · reported by security@ubuntu.comLow 3.3
The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable.CVE-2026-35342 · Other software · Uutils · reported by security@ubuntu.comLow 3.3
The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files.CVE-2026-35341 · Other software · Uutils · reported by security@ubuntu.comHigh 7.1
A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations.CVE-2026-35340 · Other software · Uutils · reported by security@ubuntu.comMedium 5.5
A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files.CVE-2026-35339 · Other software · Uutils · reported by security@ubuntu.comMedium 5.5
The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism.CVE-2026-35338 · Other software · Uutils · reported by security@ubuntu.comHigh 7.3
A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.
- Product
- coreutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026A flaw was found in binutils.CVE-2026-6846 · Other software · Red Hat · reported by Red HatHigh 7.8
A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or cause a denial of service, making the system unavailable.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 22, 2026A flaw was found in binutils, specifically within the `readelf` utility.CVE-2026-6845 · Other software · Red Hat · reported by Red HatMedium 5
A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 22, 2026A flaw was found in the `readelf` utility of the binutils package.CVE-2026-6844 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the `readelf` utility becoming unresponsive or crashing, leading to a denial of service.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Apr 21, 2026Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users toCVE-2025-1241 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.8
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utilsCVE-2026-35667 · Other software · OpenClaw · reported by VulnCheckMedium 6.9
OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKILL immediately without graceful SIGTERM shutdown. Attackers can trigger process termination via the !stop command, causing data corruption, resource leaks, and skipped security-sensitive cleanup operations.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Apr 8, 2026An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers.CVE-2026-4483 · Other software · Moxa · reported by psirt@moxa.comHigh 7
An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGeneralIo, exposes IOCTL methods that permit direct read and write access to MSR and system memory. A local attacker with high privileges could abuse these interfaces to perform unauthorized operations. Successful exploitation may result in privilege escalation on Windows 7 systems or cause a system crash (BSoD) on Windows 10 and 11 systems, leading to a denial-of-service condition. The vulnerability could slightly affect the confidentiality and integrity of the device, but availability might be heavily impacted. No impact to the subsequent system has been identified.
- Product
- MxGeneralIo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026coursevault-preview is a utility for previewing course material files from a configured directory.CVE-2026-35613 · Other software · moritzmyrz · reported by GitHubMedium 5.1
coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This vulnerability is fixed in 0.1.1.
- Product
- coursevault-preview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026openFPGALoader is a utility for programming FPGAs.CVE-2026-35176 · Other software · trabucayre · reported by GitHubHigh 7.1
openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in POFParser::parseSection() that allows out-of-bounds heap memory access when parsing a crafted .pof file. No FPGA hardware is required to trigger this vulnerability.
- Product
- openFPGALoader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026openFPGALoader is a utility for programming FPGAs.CVE-2026-35170 · Other software · trabucayre · reported by GitHubHigh 7.1
openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in BitParser::parseHeader() that allows out-of-bounds heap memory access when parsing a crafted .bit file. No FPGA hardware is required to trigger this vulnerability.
- Product
- openFPGALoader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026util-linux is a random collection of Linux utilities.CVE-2026-27456 · Other software · util-linux · reported by GitHubMedium 4.7
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has
- Product
- util-linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026A flaw was found in util-linux.CVE-2026-3184 · Other software · Red Hat · reported by Red HatLow 3.7
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 2, 2026XZ Utils provide a general-purpose data-compression library plus command-line tools.CVE-2026-34743 · Other software · tukaani-project · reported by GitHubLow 1.7
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
- Product
- xz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026The VSL privileged helper does utilize NSXPC for IPC.CVE-2026-24068 · Other software · Vienna Symphonic Library GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all. This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol. No validation is performed in the functions "writeReceiptFile" and “runUninstaller” of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation.
- Product
- Vienna Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Mar 25, 2026Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642.CVE-2025-67030 · Other software · Red Hat · reported by MITREHigh 8.8
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
- Product
- Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 24, 2026NULL Pointer Dereference vulnerability in taurusxin ncmdump (src/utils modules).CVE-2026-4743 · Other software · taurusxin · reported by cve_disclosure@tech.gov.sgMedium 5.2
NULL Pointer Dereference vulnerability in taurusxin ncmdump (src/utils modules). This vulnerability is associated with program files cJSON.Cpp. This issue affects ncmdump: before 1.4.0.
- Product
- ncmdump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TeamJCD JoyConDroid (app/src/main/java/com/rdapps/gamepad/util mCVE-2026-4741 · Other software · TeamJCD · reported by cve_disclosure@tech.gov.sgHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TeamJCD JoyConDroid (app/src/main/java/com/rdapps/gamepad/util modules). This vulnerability is associated with program files UnzipUtil.Java. This issue affects JoyConDroid: through 1.0.93.
- Product
- JoyConDroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Deserialization of Untrusted Data vulnerability in DTStack chunjun (chunjun-core/src/main/java/com/dtstack/chunjun/util modules).CVE-2026-4735 · Other software · DTStack · reported by cve_disclosure@tech.gov.sgHigh 8.7
Deserialization of Untrusted Data vulnerability in DTStack chunjun (chunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnerability is associated with program files GsonUtil.Java. This issue affects chunjun: before 1.16.1.
- Product
- chunjun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables.CVE-2026-4647 · Other software · Red Hat · reported by Red HatMedium 6.1
A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 23, 2026Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigIntegerCVE-2026-4603 · Other software · Kjur · reported by report@snyk.ioLow 2
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero.
- Product
- Jsrsasign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.