Posted by Marco Benatto on Nov 11 Hello all, on behalf of Red Hat Product Security team I'm disclosing a flaw in the xfs_admin utility present in the xfsprogs suite, where xfs_admin lacks use input validation. This allows OS command injection and under certain circumstances, results in local privilege escalation. Red Hat Product Security has assigned CVE-2026-108472 for this issue, with the severity of Important and the following CVSSv3.1 scoring: 7.8...
CVE-2026-108472 - xfs_admin allows for OS command injection
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/676
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-126641: ansible-pylibssh / ansible.netcommon libssh: changed SSH host key accepted when host_key_auto_add is enabled
Posted by Ryo utomo on Nov 12 Hello, This is a public disclosure of CVE-2026-126641, a host key verification flaw in ansible-pylibssh and in the ansible.netcommon libssh…
dbus: multiple denial-of-service issues
Posted by Simon McVittie on Nov 12 Today's dbus 1.16.4 release includes fixes for several denial-of-service issues. Another local denial of service, dbus#589 (see…
Re: Incomplete fix for Emacs CVE-2026-79992
Posted by Sam James on Oct 14 Sean Whitton writes: Red Hat, would you be willing to provide another CVE for this? Thank you.
Security Agencies Worldwide Found to Use Ad-Based Surveillance System
An investigation by Bloomberg into Penlink’s ad-based surveillance system Webloc builds off Citizen Lab research, identifying additional customers of the tracking…
CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability
CVE-2026-119618 is a critical race condition in mod_http2, the HTTP/2 module of the Apache HTTP Server. Improper synchronization of a shared resource in the module’s…
VU#580079: Arbitrary file read/write vulnerability in ImageMagick-based applications with default configuration
Overview Multiple arbitrary file read and write vulnerabilities have been identified in applications that use ImageMagick with insufficiently restrictive security…