CVE Vulnerabilities - 16 October 2026

A DNS client can crash the CoreDNS server if it requests a specific type of transfer. This can happen if you're using a certain type of DNS zone transfer with CoreDNS. To fix this, update to CoreDNS v...

Versions 7.3 through 7.6 of IBM i may let an outsider change or interfere with transaction processing across multiple systems because the software does not correctly check transaction identifiers supp...

Versions 4.0.0 to 4.1.2 of the Wheels package can be tricked into reading files outside its intended folders when the operating system treats file names as case‑sensitive. This happens because the sof...

The libarchive library used in Debian and Red Hat (including hardened images and RHEL 6, 7, and 10) may crash or leak information when processing certain Mac metadata. An attacker who can provide a cr...

The gpgtar tool in GnuPG versions before 2.5.19 may follow existing symbolic links and overwrite files outside the intended extraction folder when a crafted archive is unpacked with the -C option. Thi...

The gpgtar tool that comes with GnuPG versions before 2.5.19 may follow a symbolic link inside an archive and write or replace files outside the folder you told it to extract to. This can happen when ...

The gpgtar tool in GnuPG version 2 up to 2.5.18 can be tricked into overwriting files outside the intended folder when extracting a crafted archive into a directory that already contains a symbolic li...

The GnuPG tool (version before 2.5.19) can be tricked into writing over existing files if you extract an untrusted archive into a directory that already contains a shortcut (symlink). This happens bec...

The libsoup library used in OpenEuler can keep proxy login details and mistakenly forward them to a different proxy when the proxy settings change. This could expose usernames and passwords to an unin...

ClickMigrate versions before 1.0.3 let a specially crafted migration name be used with the "revision -m" option to place a .sql file anywhere the user can write. This could happen if an automation scr...

The libblockdev library used in Red Hat Enterprise Linux 7, 8, 9, and 10 allows anyone on the system to change the label of NTFS or FAT filesystems without proper checks. By giving a label that starts...

The pest_grammars library used for parsing JSON can run out of memory stack when it processes very deeply nested data, causing the program to stop working. This can be triggered by specially crafted J...

The Flatpak tool on Linux can let a malicious add‑on look inside the computer’s file system and show folder contents to the sandboxed program. It also makes it impossible for a user to stop a download...

Flatpak on openEuler can let a malicious extension see which files and folders exist on the host, and it can reveal directory listings to sandboxed apps. The same flaw also lets an attacker prevent a ...

The Flatpak system on openEuler can let a malicious extension see what files and folders exist on the computer and reveal directory listings to isolated apps. It can also prevent users from stopping a...

Flatpak on openEuler may let a malicious extension see the names of files and folders on the host system and place its files in the wrong location inside an app's sandbox. It also fails to stop a down...

The data‑table component in CKAN MCP Server receives messages from other web frames without checking where they come from, and it sends its replies to any destination. As a result, a malicious page th...

Versions of tarteaucitron.js before 1.37 let an attacker create a specially formatted cookie name that causes the page to stop responding when the user clicks the purge button. This can be used to blo...

Version 1.0 of IBM Db2 Genius Hub can let someone who has a legitimate account avoid the normal encryption step, which may let them get past access controls. This could expose data or functions they s...

The WP Mail Logging plugin for WordPress lets anyone with an admin account request a personal data export using a specially crafted email address. By doing so, the admin can see full email messages, s...

The Product Delivery Date plugin for WooCommerce can show order details to users who only have the Contributor role. This means people who should not see customer information could view it through the...

The Smush image‑optimization plugin for WordPress (versions before 4.3.4) allows a site admin on a multisite installation to modify settings that affect every site on the network. This could unintenti...

In Devolutions Server versions up to 2026.3.8.0, a low‑privilege account can trick the system into sending out the stored PingOne application secret. This happens because the server can be made to req...

The popt library used on openeuler can crash when it tries to format help information that is wider than the screen. This can cause the application to stop working or fail to display its help text, ef...

The popt library used for processing command-line options on openeuler can crash when it tries to show help text that is wider than the screen. A user who can cause the program to print such help coul...