CVE-2026-111253Medium· 6.6▾ SunlitA flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-man…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. If the legitimate session party later authorizes execution, the root daemon may apply the attacker-chosen package operations.
dnf5 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Until a fixed build is available, avoid leaving interactive dnf5daemon sessions open on multi-user systems where untrusted local accounts can access the system bus, and close sessions promptly after use.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114232High· 8.1Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access
CVE-2026-107912High· 7.7Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
CVE-2024-9671Medium· 5.3System: pdf invoices of the developer users can be seen if the url is known
CVE-2026-93010Medium· 4.3Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
CVE-2026-19610Medium· 6.5Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
CVE-2026-117627Medium· 5.4Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions