mcdope vulnerabilities

Newest CVEs

• CVE-2026-48980

  pam_usb: getenv() used in PAM context allows environment variable injection into local-check logic

  mcdope · pam_usb

  Medium6.3
• CVE-2026-48983

  pam_usb: TOCTOU race condition in pad directory creation allows symlink substitution

  mcdope · pam_usb

  Medium5.8
• CVE-2026-48982

  pam_usb: Missing O_EXCL on pad temp file creation allows concurrent update race

  mcdope · pam_usb

  Medium5.8
• CVE-2026-48981

  pam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c

  mcdope · pam_usb

  Medium6.7
• CVE-2026-48985

  pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field

  mcdope · pam_usb

  Medium5.5
• CVE-2026-48986

  pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication

  mcdope · pam_usb

  Medium4.7
• CVE-2026-48984

  pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap

  mcdope · pam_usb

  Medium4.7
• CVE-2026-44712

  pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent

  mcdope · pam_usb

  High8.2
• CVE-2026-44709

  pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution

  mcdope · pam_usb

  High7.8
• CVE-2026-44710

  pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service

  mcdope · pam_usb

  Medium4.6