https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T09:10:12.048157+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:50141 ALSA-2026:50141 — Important: sg3_utils security, bug fix, and enhancement update 2026-10-04T09:10:12.463840+00:00

Affected: AlmaLinux:9: sg3_utils, AlmaLinux:9: sg3_utils-devel, AlmaLinux:9: sg3_utils-libs

The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.

Security Fix(es):

* sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)

Bug Fix(es) and Enhancement(s):

* sg_inq output conformance for SCSI name string and ATA fields [almalinux-9.8.z] (JIRA:AlmaLinux-188130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 certfr-2026-avi-1256 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-04T09:10:12.463944+00:00 certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/euvd-2026-380626 EUVD-2026-380626 2026-10-04T09:10:12.463977+00:00 EUVD-2026-380626 https://cve.radiocsirt.org/vuln/fkie_cve-2026-16313 fkie_cve-2026-16313 2026-10-04T09:10:12.464000+00:00

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

 https://cve.radiocsirt.org/vuln/ghsa-wqmp-fw94-rpg4 GHSA-wqmp-fw94-rpg4 2026-10-04T09:10:12.464041+00:00

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-16313 msrc_CVE-2026-16313 — Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export 2026-10-04T09:10:12.464070+00:00 msrc_CVE-2026-16313 https://cve.radiocsirt.org/vuln/oesa-2026-3244 OESA-2026-3244 — sg3_utils security update 2026-10-04T09:10:12.464097+00:00

Affected: openEuler:24.03-LTS-SP3: sg3_utils, openEuler:24.03-LTS-SP4: sg3_utils, openEuler:20.03-LTS-SP4: sg3_utils, openEuler:22.03-LTS-SP4: sg3_utils, openEuler:24.03-LTS-SP1: sg3_utils

The sg3_utils package contains utilities that send SCSI commands to devices. As well as devices on transports traditionally associated with SCSI (e.g. Fibre Channel (FCP), Serial Attached SCSI (SAS) and the SCSI Parallel Interface(SPI)) many other devices use SCSI command sets. ATAPI cd/dvd drives and SATA disks that connect via a translation layer or a bridge device are examples of devices that use SCSI command sets. Security Fix(es):

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.(CVE-2026-16313)

 https://cve.radiocsirt.org/vuln/rhsa-2026:50141 RHSA-2026:50141 — Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update 2026-10-04T09:10:12.464149+00:00

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

 https://cve.radiocsirt.org/vuln/rhsa-2026:54769 RHSA-2026:54769 — Red Hat Security Advisory: OpenShift Container Platform 4.22.10 bug fix and security update 2026-10-04T09:10:12.464179+00:00

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O samba: Missing access check on reparse point operations libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. unbound: Unbound: Cache manipulation via 'ghost domain names' attack unbound: Unbound: Denial of Service via excessive EDNS options vim: Vim: Arbitrary Code Execution via crafted directory names vim: Vim: Arbitrary code execution via crafted step-definition patterns vim: Vim: Arbitrary code execution via Python omni-completion acl: Symlink traversal privilege escalation via libacl functions vim: Vim: Out-of-bounds Write in Spell File Word Count vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion openssh: OpenSSH: Use-after-free vulnerab…

 https://cve.radiocsirt.org/vuln/rlsa-2026:50141 RLSA-2026:50141 — Important: sg3_utils security, bug fix, and enhancement update 2026-10-04T09:10:12.464269+00:00

Affected: Rocky Linux:9: sg3_utils

The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.

Security Fix(es):

* sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)

Bug Fix(es) and Enhancement(s):

* sg_inq output conformance for SCSI name string and ATA fields [rhel-9.8.z] (JIRA:Rocky Linux-188130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-16313 UBUNTU-CVE-2026-16313 2026-10-04T09:10:12.464321+00:00

Affected: Ubuntu:14.04:LTS: sg3-utils, Ubuntu:16.04:LTS: sg3-utils, Ubuntu:18.04:LTS: sg3-utils, Ubuntu:20.04:LTS: sg3-utils, Ubuntu:22.04:LTS: sg3-utils, Ubuntu:24.04:LTS: sg3-utils, Ubuntu:26.04:LTS: sg3-utils

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2645 WID-SEC-W-2026-2645 — Red Hat Enterprise Linux (sg3_utils): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorr… 2026-10-04T09:10:12.464372+00:00

Ein Angreifer mit physischem Zugriff kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.