CVE-2023-5557High· 7.5▾ TwilightA flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.8%
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-miners (all versions)tracker-minersRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-83494NoneTraining-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)
CVE-2026-123876Medium· 4.4Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
CVE-2026-120749Medium· 6.2Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
CVE-2026-123037Medium· 6.7Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
CVE-2026-121837Medium· 4.3Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
CVE-2026-109081Medium· 6.8Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint