https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:15:02 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:55560 <p><strong>Affected:</strong> AlmaLinux:8: pcp-conf, AlmaLinux:8: pcp-devel, AlmaLinux:8: pcp-doc, AlmaLinux:8: pcp-export-pcp2elasticsearch, AlmaLinux:8: pcp-export-pcp2graphite, AlmaLinux:8: pcp-export-pcp2influxdb, AlmaLinux:8: pcp-export-pcp2json, AlmaLinux:8: pcp-export-pcp2spark, AlmaLinux:8: pcp-export-pcp2xml, AlmaLinux:8: pcp-export-pcp2zabbix and 68 more</p> <p>Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.</p> <p>Security Fix(es):</p> <p>* PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524) * PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526) * PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527) * PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: pcp-conf, AlmaLinux:8: pcp-devel, AlmaLinux:8: pcp-doc, AlmaLinux:8: pcp-export-pcp2elasticsearch, AlmaLinux:8: pcp-export-pcp2graphite, AlmaLinux:8: pcp-export-pcp2influxdb, AlmaLinux:8: pcp-export-pcp2json, AlmaLinux:8: pcp-export-pcp2spark, AlmaLinux:8: pcp-export-pcp2xml, AlmaLinux:8: pcp-export-pcp2zabbix and 68 more</p> <p>Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.</p> <p>Security Fix(es):</p> <p>* PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524) * PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526) * PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527) * PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:55560 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/euvd-2026-381987 EUVD-2026-381987 https://cve.radiocsirt.org/vuln/euvd-2026-381987 https://cve.radiocsirt.org/vuln/fkie_cve-2026-16529 <p>A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.</p> <p>A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-16529 https://cve.radiocsirt.org/vuln/ghsa-hm96-wjh8-qqgm <p>A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.</p> <p>A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.</p> https://cve.radiocsirt.org/vuln/ghsa-hm96-wjh8-qqgm https://cve.radiocsirt.org/vuln/oesa-2026-3807 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: pcp</p> <p>Performance Co-Pilot (PCP) provides a framework and services to support system-level performance monitoring and performance management. Security Fix(es):</p> <p>A command injection flaw in PCP&amp;apos;s linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.(CVE-2026-16524)</p> <p>A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.(CVE-2026-16526)</p> <p>An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.(CVE-2026-16527)</p> <p>A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.(CVE-2026-16529)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: pcp</p> <p>Performance Co-Pilot (PCP) provides a framework and services to support system-level performance monitoring and performance management. Security Fix(es):</p> <p>A command injection flaw in PCP&amp;apos;s linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.(CVE-2026-16524)</p> <p>A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.(CVE-2026-16526)</p> <p>An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.(CVE-2026-16527)</p> <p>A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.(CVE-2026-16529)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3807 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11490-1 <p>libpcp-devel-6.3.8-3.1 on GA media</p> <p>libpcp-devel-6.3.8-3.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11490-1 https://cve.radiocsirt.org/vuln/rhsa-2026:72272 <p>PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules PCP: PCP: Denial of Service due to signed integer overflow</p> <p>PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules PCP: PCP: Denial of Service due to signed integer overflow</p> https://cve.radiocsirt.org/vuln/rhsa-2026:72272 https://cve.radiocsirt.org/vuln/rlsa-2026:55560 <p><strong>Affected:</strong> Rocky Linux:8: pcp</p> <p>Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.</p> <p>Security Fix(es):</p> <p>* PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524)</p> <p>* PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526)</p> <p>* PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527)</p> <p>* PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:8: pcp</p> <p>Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.</p> <p>Security Fix(es):</p> <p>* PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524)</p> <p>* PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526)</p> <p>* PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527)</p> <p>* PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:55560 https://cve.radiocsirt.org/vuln/suse-su-2026:23064-1 <p>Security update for pcp</p> <p>Security update for pcp</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23064-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-16529 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: pcp, Ubuntu:18.04:LTS: pcp, Ubuntu:20.04:LTS: pcp, Ubuntu:22.04:LTS: pcp, Ubuntu:24.04:LTS: pcp, Ubuntu:26.04:LTS: pcp</p> <p>A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: pcp, Ubuntu:18.04:LTS: pcp, Ubuntu:20.04:LTS: pcp, Ubuntu:22.04:LTS: pcp, Ubuntu:24.04:LTS: pcp, Ubuntu:26.04:LTS: pcp</p> <p>A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-16529 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2868 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux (pcp) ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um Sicherheitsvorkehrungen zu umgehen, und um einen Denial of Service Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux (pcp) ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um Sicherheitsvorkehrungen zu umgehen, und um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2868