CVE Vulnerability Catalog

A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original setuid/setgid bits.

The curl_url_get() function in libcurl offers punycode conversions to and from IDN. When converting a name that is exactly 256 bytes, libcurl reads outside a stack-based buffer when built with the macidn IDN backend.

An improper access control vulnerability in AMD SEV-SNP allows an admin privileged attacker to write to the RMP during SNP initialization, potentially leading to loss of SEV-SNP guest memory integrity.

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. It falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID instead of the source's metadata.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_copy_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.

In NTFS-3G through version 2026.2.25, a heap buffer overflow in ntfs_index_walk_down() in libntfs-3g/index.c allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image.

In NTFS-3G through version 2026.2.25, an out-of-bounds read vulnerability exists in the ntfs_fix_file_name() function in libntfs-3g/reparse.c. An attacker can exploit this by crafting a malicious NTFS image, leading to the disclosure of confidential information from ntfs-3g process memory when a readlink is performed on a corrupted reparse point.

In NTFS-3G through version 2026.2.25, a heap buffer overflow exists in the ntfs_ib_cut_tail() function in libntfs-3g/index.c. This vulnerability allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted directory.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access can exploit this race condition.

The mongo-go-driver contains a heap out-of-bounds read vulnerability in the CGo implementation for GSSAPI (Kerberos) authentication on Linux and macOS. The issue arises from incorrect assumptions about string termination in the GSSAPI standard, potentially leading to data disclosure.

A TOCTOU vulnerability in the split utility of uutils coreutils allows an attacker to replace the output file between the check and use, potentially leading to data loss. The flaw occurs because the program checks file identity based on paths but later opens the file without re-verification.

The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file before the permission change.

The 'id' utility in uutils coreutils incorrectly displays data in 'pretty print' mode when the real UID differs from the effective UID. The implementation mistakenly uses the effective GID instead of the effective UID when looking up the name of the effective user, leading to misleading output.

A TOCTOU vulnerability in the cp utility of uutils coreutils allows an attacker to bypass the intended no-dereference behavior. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag.

In NTFS-3G through version 2026.2.25, an out-of-bounds read vulnerability exists in the ntfs_ir_nill() function in libntfs-3g/index.c. An attacker can exploit this by crafting a malicious NTFS image containing a file with a specially crafted name, leading to the disclosure of potentially confidential information from the ntfs-3g process memory.

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644).

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation, which a local attacker with write access to the destination directory can exploit.

An improper initialization vulnerability in the AMD Secure Encrypted Virtualization (SEV) firmware allows an admin-privileged attacker to corrupt RMP-covered memory, potentially leading to loss of guest memory integrity.

The touch utility in uutils coreutils is vulnerable to a TOCTOU race condition during file creation. After identifying a missing path, the utility later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file.