https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:55:23 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:7592 <p><strong>Affected:</strong> AlmaLinux:10: yggdrasil, AlmaLinux:10: yggdrasil-devel</p> <p>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child &#34;worker&#34; process, exchanging data with its worker processes through a D-Bus message broker.</p> <p>Security Fix(es):</p> <p>* yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: yggdrasil, AlmaLinux:10: yggdrasil-devel</p> <p>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child &#34;worker&#34; process, exchanging data with its worker processes through a D-Bus message broker.</p> <p>Security Fix(es):</p> <p>* yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:7592 https://cve.radiocsirt.org/vuln/euvd-2026-260504 EUVD-2026-260504 https://cve.radiocsirt.org/vuln/euvd-2026-260504 https://cve.radiocsirt.org/vuln/fkie_cve-2025-3931 <p>A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children&#39;s &#34;worker&#34; processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages.</p> <p>This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data.</p> <p>A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children&#39;s &#34;worker&#34; processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages.</p> <p>This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-3931 https://cve.radiocsirt.org/vuln/ghsa-rpg2-jvhp-h354 <p><strong>Affected:</strong> Go: github.com/redhatinsights/yggdrasil</p> <p>A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children&#39;s &#34;worker&#34; processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages.</p> <p>This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data.</p> <p><strong>Affected:</strong> Go: github.com/redhatinsights/yggdrasil</p> <p>A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children&#39;s &#34;worker&#34; processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages.</p> <p>This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data.</p> https://cve.radiocsirt.org/vuln/ghsa-rpg2-jvhp-h354 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15135-1 <p>govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15135-1 https://cve.radiocsirt.org/vuln/rhsa-2025:7592 <p>golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect yggdrasil: Local privilege escalation in yggdrasil</p> <p>golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect yggdrasil: Local privilege escalation in yggdrasil</p> https://cve.radiocsirt.org/vuln/rhsa-2025:7592 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1059 <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in Yggdrasil ausnutzen, um seine Privilegien zu erhöhen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in Yggdrasil ausnutzen, um seine Privilegien zu erhöhen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1059