rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

CVE-2026-35363

`rm -rf .` is correctly refused, but `clean_trailing_slashes` normalizes `.///` to `./` while `path_is_current_or_parent

历史摘要 · 未重新核验 · GitHub Advisory

comm: FIFO/pipe inputs are drained before comparison (data loss / hang)

CVE-2026-35347

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison

历史摘要 · 未重新核验 · GitHub Advisory

id: groups= computed from real GID instead of effective GID

CVE-2026-35370

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's rea

历史摘要 · 未重新核验 · GitHub Advisory

mkdir: -m exposes directory with umask perms before chmod (race window)

CVE-2026-35353

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory wit

历史摘要 · 未重新核验 · GitHub Advisory

rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

CVE-2026-35349

The `--preserve-root` check uses a path-string test (`path.has_root() && path.parent().is_none()`) rather than comparing

历史摘要 · 未重新核验 · GitHub Advisory

id: pretty-print uses effective GID instead of effective UID for name lookup

CVE-2026-35371

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effect

历史摘要 · 未重新核验 · GitHub Advisory

kill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS)

CVE-2026-35369

`kill -1` is incorrectly parsed as a positional `pid = -1`; combined with the default SIGTERM this calls `kill(-1, SIGTE

历史摘要 · 未重新核验 · GitHub Advisory

install -D: symlink race in directory creation allows arbitrary file overwrite

CVE-2026-35356

The `-D` path runs `fs::create_dir_all` on a pathname then later opens the destination via path-based `File::create`/`fs

历史摘要 · 未重新核验 · GitHub Advisory

cut: -s (only-delimited) ignored when delimiter is a newline

CVE-2026-35343

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is speci

历史摘要 · 未重新核验 · GitHub Advisory

install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite

CVE-2026-35355

`copy_file` in `install/src/install.rs` removes the destination then recreates it by pathname via `File::create` / `fs::

历史摘要 · 未重新核验 · GitHub Advisory

ln: rejects non-UTF-8 source filenames in target-directory mode

CVE-2026-35373

In target-directory forms (`ln SOURCE... DIRECTORY`), `ln` rejects source paths with non-UTF-8 filename bytes, while GNU

历史摘要 · 未重新核验 · GitHub Advisory

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

CVE-2026-35346

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. Th

历史摘要 · 未重新核验 · GitHub Advisory

mktemp: empty TMPDIR creates temp files in CWD instead of /tmp

CVE-2026-35342

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp,

历史摘要 · 未重新核验 · GitHub Advisory

chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)

CVE-2026-35339

In `Chmoder::chmod()` the recursive branch overwrites the running result instead of accumulating it, so the exit code re

历史摘要 · 未重新核验 · GitHub Advisory

jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

CVE-2026-52834

### Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in l

历史摘要 · 未重新核验 · GitHub Advisory

jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow

### Summary `jxl-oxide` exposes a public safe API that can construct an undersized `FrameBuffer` due to unchecked `usize

历史摘要 · 未重新核验 · GitHub Advisory

jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)

### Summary Logic bug in `decode_simple_table_slow` may cause integer arithmetic overflow when decoding Modular image wi

历史摘要 · 未重新核验 · GitHub Advisory

Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

CVE-2026-52829

### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node listens on the d

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

CVE-2026-49997

In SurrealDB, records can be connected as a graph: a `RELATE` statement creates an edge record between two node records.

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

When a user configures `ALGORITHM ES512` for any JWT access method (`DEFINE ACCESS ... TYPE JWT ALGORITHM ES512`), Surre

历史摘要 · 未重新核验 · GitHub Advisory