Threat database

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.

A path traversal vulnerability exists in Linux Mint Xreader versions 4.6.0 through 4.6.5 in the EPUB File Handler component. This flaw allows remote attackers to manipulate file paths via the setup_document_content_list/g_strdup_printf function in the backend/epub/epub-document.c file. The vulnerability is addressed by upgrading to version 4.6.6. Notably, EPUB support was removed from Xreader and reimplemented in a separate project called Xepub.

CVE-2026-82552 is a medium severity denial of service vulnerability in Linux Foundation Magma version 1.9.0. It affects an unknown functionality within the gNB Termination Handler component, specifically in the file tasks/ngap/ngap_amf.c. The vulnerability can be exploited remotely without user interaction or elevated privileges. Public exploit code has been disclosed, but there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available.

CVE-2026-82551 is a medium-severity vulnerability in Linux Foundation Magma version 1.9.0. It involves a state issue in an unknown function within the NGSetup Handler component (file ngap_amf_handlers.c). The vulnerability can be exploited remotely without authentication or user interaction. Public exploit code is available. No official patch or remediation guidance has been provided yet.

CVE-2026-82550 is a medium severity vulnerability in Linux Foundation Magma version 1.9.0. It involves improper input validation in the NGSetupRequest Handler component when manipulating the NG-IoT-DefaultPagingDRX argument. The flaw allows remote exploitation without requiring privileges or user interaction. Public exploit code is available, but no official patch or remediation has been announced by the vendor.

CVE-2026-82549 is a medium severity vulnerability in Linux Foundation Magma version 1.9.0. It involves improper validation of an integrity check value in the SecurityModeComplete Handler component. The vulnerability can be exploited remotely without authentication. Public exploit code is available. No official patch or remediation guidance has been provided yet.

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Linux Foundation Magma 1.9.0. The affected element is an unknown function of the file tasks/amf/amf_fsm.cpp of the component Registration Complete Message Handler. The manipulation results in improper authentication. The attack can be launched remotely. The exploit has been made public and could be used.

CVE-2022-0995 is an out-of-bounds memory write vulnerability in the Linux Kernel that allows a local user to gain privileged access or cause a denial of service. It has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2026-73974 is a path traversal vulnerability in linuxfabrik monitoring-plugins prior to version 7.0.0 and linuxfabrik-lib prior to 6.1.0. The issue arises because the test helper function lib.lftest.test() improperly handles filesystem paths from a hidden --test argument, allowing unauthorized file reads without path confinement. This vulnerability enables an attacker with sudo-authorized plugin access to read arbitrary root-readable files. The flaw affects multiple plugins that expose file content or existence checks. The vulnerability is fixed by confining fixture reads to a safe directory and routing bypasses through the helper in the fixed versions.

Linuxfabrik monitoring-plugins prior to version 7.0.0 contain a path traversal vulnerability in the logfile check plugin. The plugin accepts a free-form --filename argument and opens the specified file as root without restricting the path to /var/log. This allows an attacker with control over the monitoring account to read arbitrary root-readable files such as /etc/shadow. The issue is fixed in version 7.0.0 by confining paths to documented log roots and resolving symlinks and parent-directory traversal before access.

CVE-2026-48154 is a race condition vulnerability in pilinux gorest versions prior to 1.12.2. It arises from unsynchronized concurrent access to a package-level map used to store 2FA secrets, causing the Go runtime to crash the process. This results in a high availability impact but does not affect confidentiality or integrity. The issue has been fixed in version 1.12.2.

CVE-2026-67436 is a high-severity vulnerability in Linuxfabrik monitoring-plugins version 6.0.0 and earlier. The redfish-* plugins construct request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links. This improper input validation allows a malicious or compromised Baseboard Management Controller (BMC) to redirect authenticated Redfish requests, potentially exposing X-Auth-Token or HTTP Basic credentials.

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch() followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious redirect-capable server to receive headers such as X-Auth-Token from authenticated monitoring requests. This issue is fixed in version 6.0.0.

CVE-2026-67433 is a medium severity vulnerability in Linuxfabrik monitoring-plugins version 6.0.0. It involves improper link resolution before file access, where a local user controlling the plugin account can create a symbolic link in a predictable /tmp path. This symlink is followed by sqlite3.connect() during a root-run check, potentially leading to unauthorized file access or modification.

CVE-2026-59677 is a missing authorization vulnerability in SELinux's policycoreutils seunshares component. It allows a user running in an unconfined context to kill processes, including those owned by root, that are also running in an unconfined context. This affects policycoreutils versions up to and including 3.10.

An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager. This issue affects PortProtonQt before 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe.