Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.
This issue affects iSulad: through 2.1.6.
The memory leak vulnerability causes the iSulad daemon to be triggered frequently, exhausting the host machine's memory and ultimately leading to an OOM crash of the daemon, resulting in a denial of service (DoS).
Relative path traversal vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
In oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host.
Red Hat has issued a security advisory for util-linux packages addressing three vulnerabilities: a heap use-after-free in libblkid nested partition probing (CVE-2026-13595), a time-of-check to time-of-use (TOCTOU) race condition in the mount program via ancestor directory swap (CVE-2026-53613), and an integer overflow in the DOS partition parser leading to partition metadata compromise (CVE-2026-53615). These vulnerabilities affect low-level system utilities critical for Linux system functionality. The update is rated as Important by Red Hat Product Security and applies to Red Hat Enterprise Linux 9.8 Extended Update Support and related variants. A fix is available through updated packages provided by Red Hat.
A security vulnerability in Vim (Vi IMproved) allows arbitrary code execution due to a Vimscript injection via an unescaped filename in the netrw s:NetrwMarkFile() filter() expression. This issue is tracked as CVE-2026-43961 and affects Red Hat Enterprise Linux 9.8 Extended Update Support versions. Red Hat has released an update addressing this vulnerability along with other bug fixes and enhancements.
Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
When the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.
UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.
This issue affects iSulad: through 2.1.6.
If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.
CVE-2026-76954 is a critical vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. It involves improper neutralization of special elements in SQL commands within the Auth API, allowing remote attackers to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-85101 is an authentication bypass vulnerability in the rsync component of Synology DiskStation Manager (DSM) versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. This flaw allows remote attackers to bypass authentication using an alternate path or channel, enabling them to read specific files, write arbitrary files, and perform limited denial-of-service attacks.
A denial of service vulnerability exists in the Qt software toolkit's QXmlStreamReader component due to crafted XML parsing. This issue is identified as CVE-2026-16762 and affects the qt5-qtbase packages used in Red Hat Enterprise Linux 9.8 Extended Update Support. The vulnerability allows an attacker to cause a denial of service condition by exploiting the XML parsing functionality.
CVE-2026-88266 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions prior to 7.3.2-86009-5 and 7.4.1-90080-1. It allows remote authenticated users to write specific files via the synomount component, potentially leading to unauthorized configuration changes. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-81559 is a missing authorization vulnerability in the TaskScheduler API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-81558 is a medium-severity vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves missing authorization in the SocketIo API, allowing remote authenticated users to write specific files.
CVE-2026-77738 is a server-side request forgery (SSRF) vulnerability in the Credential API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. It allows remote authenticated users to read specific files on the system. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-74850 is a medium severity vulnerability in Synology DiskStation Manager (DSM) prior to versions 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper limitation of a pathname to a restricted directory in the contentextract component, allowing remote authenticated users to read specific files they should not have access to.
CVE-2026-19414 is a missing authorization vulnerability in the Promotion API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-85098 is a reachable assertion vulnerability in the synoscgi component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote attackers to cause limited denial-of-service (DoS) conditions. The vulnerability does not impact confidentiality or integrity but affects availability. It has a CVSS 3.1 base score of 5.3, indicating medium severity.
CVE-2026-124993 is an incorrect authorization vulnerability in the Security Advisor component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote attackers to read specific files without proper authorization. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited confidentiality impact and no integrity or availability impact.
CVE-2026-92379 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of input during web page generation in the Notification API, allowing remote authenticated users to read or write specific files. The vulnerability has a medium severity with a CVSS score of 5.4.
CVE-2026-81557 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of input during web page generation in the DSMNotify component. This flaw allows remote authenticated users to read or write specific files on the system.
CVE-2026-19833 is a missing authorization vulnerability in the ACL API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to read or write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 5.4.