Linux Foundation

Related CVEsby mentions

• CVE-2023-491059.843%
  Improper Authentication in ownCloud Server Allows Unauthenticated File Access
  ownCloud Server versions from 10.6.0 up to (but not including) 10.13.1 accept WebDAV pre-signed URLs even when no signing key is configured for the file owner, an improper authentication flaw (CWE-287). A remote attacker who knows a victim's username can therefore access, modify, or delete that user's files without any credentials, with no privileges or user interaction required (CVSS 9.8). Any organization running a self-hosted ownCloud Server instance in the affected version range is exposed, especially internet-facing deployments. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-27, confirming exploitation in the wild, and EPSS assigns a 43.2% probability of exploitation within 30 days (99th percentile). No public proof-of-concept code is known, but recent press reports of attacks against ownCloud (including theft of records at a Philippine research body) indicate active targeting of ownCloud flaws.
  · ownCloud Server (owncloud/core) 10.6.0 through all versions before 10.13.1; fixed in 10.13.1 KEVlarge
• CVE-2026-533627.8<1%
  Out-of-Bounds Write in Linux Kernel IPv6 Stack via UDPv6 MSG_SPLICE_PAGES
  CVE-2026-53362 is an out-of-bounds write (CWE-787) in the Linux kernel's IPv6 output path: __ip6_append_data() mis-accounts fraggap bytes on the paged-allocation branch, leaving the new skb's linear area undersized so the copy of carried-over fragment-gap data spills past skb->end into the trailing skb_shared_info. An unprivileged local user can trigger the corruption by sending over a UDPv6 socket using MSG_MORE combined with MSG_SPLICE_PAGES; the bad accounting was introduced by commit 773ba4fe9104 ('ipv6: avoid partial copy for zc') and became triggerable when commit ce650a166335 allowed the MSG_SPLICE_PAGES case to proceed instead of returning -EINVAL. Successful triggering causes kernel memory corruption that, per the high confidentiality/integrity/availability scores, can lead to loss of data confidentiality, integrity and availability — potentially local privilege escalation or a system crash. Any Linux system running a kernel with the affected code is exposed; the source data provides no specific affected version numbers, only the introducing and trigger commits. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27, indicating known in-the-wild exploitation (ransomware use unknown), with EPSS at 0.5% and no public PoC known.
  · Linux kernel KEVmass
• CVE-2026-663845.3<1%
  Authenticated Path Traversal Write in JFrog Artifactory Exploited in the Wild
  CVE-2026-66384 is a directory/path-restriction bypass (CWE-22) in JFrog Artifactory in which an authenticated user can write data outside the intended Docker cache path when specific remote-repository conditions are met. The attack is carried out over the network using valid low-privilege credentials and requires no user interaction, but the triggering conditions are specific enough that the CVSS vector rates exploit complexity as high. A successful attacker gains unauthorized modification of files outside the cache directory (integrity impact only per the CVSS vector, with no confidentiality or availability impact scored), potentially tampering with stored content or system files depending on the deployment. Any organization running JFrog Artifactory with Docker remote repositories is potentially affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-27, confirming exploitation in the wild; no public proof-of-concept is known and ransomware use is not confirmed.
  · JFrog Artifactory KEVlarge
• CVE-2026-645309.8<1%
  In the Linux kernel, the following vulnerability has been resolved:
  In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again. tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the switch and returned the skb to the caller as if classification had passed. The only qdisc that wires up qevents today is RED, via three call sites (qe_mark on…
  —
• CVE-2026-684319.1<1%
  Unauthenticated Out-of-Bounds Read in Linux Kernel ksmbd SMB Server
  CVE-2026-68431 is an out-of-bounds read in the ksmbd in-kernel SMB server of the Linux kernel, rated 9.1 (critical) with a CVSS vector of high confidentiality and high availability impact over the network with no privileges or user interaction required. The receive path only enforces the minimum SMB2 PDU size when the packet's ProtocolId is SMB2_PROTO_NUMBER, so a packet marked as an SMB2 transform (SMB2_TRANSFORM_PROTO_NUM) skips the size check even when the negotiated dialect (e.g., SMB 2.1) provides no transform handling; the truncated request then reaches init_smb2_rsp_hdr(), which treats it as a full SMB2 header and reads past the end of the request allocation. An unauthenticated attacker with network access to an affected SMB service can send such a short transform packet and receive memory read beyond the allocation back in the response (information disclosure), and the critical CVSS score also reflects potential service-disruption impact. Any Linux system running the ksmbd SMB server and exposed over the network is affected; the source data specifies no affected or fixed version range. No public proof-of-concept or known in-the-wild exploitation exists (EPSS 0.4%, not in CISA KEV), though a Zero Day Initiative advisory (ZDI-26-573) documents the flaw.
  · Linux kernel (ksmbd SMB server subsystem)large

Appears with