A vulnerability in the Linux kernel's readdir implementation related to inode locking on immutable directories has been resolved. The issue involved iterate_dir() holding a shared lock on the directory's i_rwsem semaphore even when the directory was immutable and never changed, causing unnecessary blocking. This could lead to stalls in mount namespaces sharing the same nullfs directory inode, impacting multiple users. The fix adds a FOP_IMMUTABLE flag to skip locking for directories that never change or are never removed, preventing the described contention.
A missing authorization vulnerability exists in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9 on Android. This flaw allows a local application without any permissions to invoke privileged operations such as factory reset with user-data wipe, device shutdown, clock/timezone changes, and firmware update hand-off. The root cause is that the onTransact() method does not perform any caller-identity or permission checks.
A vulnerability in the Linux kernel's dm-integrity module was resolved involving improper validation of the superblock on resume. The dm_integrity_resume() function re-reads the superblock without validating it, allowing discrepancies if the superblock is modified while the device is suspended. This can lead to out-of-bounds memory writes during journal access. The fix involves snapshotting the validated superblock during construction and refusing to resume if critical fields have changed.
A race condition in the Linux kernel's cpuset subsystem related to CPU hotplug operations could lead to a NULL pointer dereference. This occurs because the update order of cpu_active_mask and cpu_online_mask allows a race window where the top cpuset may have no active CPU. The issue was fixed by reintroducing a NULL check in guarantee_active_cpus() to prevent dereferencing a NULL pointer.
A vulnerability in the Linux kernel's vsock/virtio subsystem related to incorrect accounting of unread bytes in the read_skb() function has been resolved. The flaw caused the rx_bytes counter to underflow after partial stream receives, leading to incorrect socket status reporting and potentially hiding queued data until additional bytes arrived. This issue was identified during a manual source audit following a previous related vulnerability (CVE-2024-50169).
A vulnerability in the Linux kernel's IPv6 UDP exception cache handling allowed off-path attackers to conduct side-channel attacks to discover ephemeral UDP ports. The issue was due to exceptions being created only when a UDP packet matched an existing socket. The fix ensures exceptions are always created before socket matching, preventing this side-channel. This change may cause additional route lookups and exceptions but does not increase the ability of attackers to create exceptions beyond previous capabilities.
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.
A vulnerability in the Linux kernel's device mapper ioctl interface was resolved where a buffer over-read could occur due to incorrect calculation of a data pointer. This issue involves the struct dm_ioctl, which has trailing padding causing the data_start pointer to run past the allocated buffer size. Although this results in an out-of-bounds read, it can only be triggered by root privileges and is therefore not considered a security bug. The fix clamps the data_start pointer to the buffer size to prevent the over-read.
A vulnerability in the Linux kernel related to IPv4 route notification sizing has been resolved. The issue involves improper handling of nexthop groups when they shrink, leading to a potential null pointer dereference in fib_nexthop_nlmsg_size(). This occurs because the code does not stop sizing when an indexed path is absent after a nexthop group replacement with fewer paths. The fix prevents dereferencing a null pointer by stopping sizing in such cases.
A vulnerability in the Linux kernel's IPv4 UDP handling allowed off-path attackers to perform a side-channel attack on the FIB nexthop exception (FNHE) cache to discover ephemeral UDP port numbers. The issue arises because FNHE entries were only created when a UDP packet matched an existing socket, enabling attackers to infer port information by observing cache behavior. Previous mitigations involving hash randomization were bypassable. The fix ensures FNHE entries are always created before socket matching, preventing attackers from distinguishing valid from invalid guesses based on cache state.
A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.
CVE-2026-106763 is a high-severity vulnerability in @justice8096/sagemath-mcp-server version 1.0.1 that allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. The vulnerability requires no privileges and has a high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form. The relogin path logs out an existing session before rendering the payload, so the demonstrated attack does not inherit that session's mailbox access. ZCS 10.1.16 and 10.1.17 are affected.
A vulnerability in @rog0x/mcp-git-tools version 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. This issue has a high severity rating with a CVSS score of 7.5. The vulnerability requires high attack complexity and no privileges but involves user interaction. No patch or remediation information is provided.
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.
A vulnerability in @rog0x/mcp-docker-tools version 1.0.1 allows remote attackers to execute arbitrary code via the handleImageList function. This issue has a high severity with a CVSS score of 7.5. The vulnerability requires user interaction and has a high attack complexity. No affected versions beyond 1.0.1 are explicitly stated, and no patch or remediation information is provided.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to qt6 packages. The advisory addresses vulnerabilities identified by CVE-2026-95509 and CVE-2026-16762. The update includes bug fixes and enhancements for qt6-filesystem and related macros across multiple architectures. No specific affected versions are detailed in the advisory. The update is available and should be applied as per Red Hat's instructions.