CVE-2026-104618

MediumCVSS 6.2/10Last modified Oct 16, 2026

Description

On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 15, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1046256.3A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/indexCVE-2026-1046268.8A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that iCVE-2026-1046275.4The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in CVE-2026-1046286.5Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with CVE-2026-1046298.8A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to lCVE-2026-1046328.8Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerunCVE-2026-1046336.5When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paCVE-2026-1046342.3Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and nullCVE-2026-1046358.2Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash CVE-2026-1046367.5Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent CVE-2026-1046377.3A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected elemCVE-2026-1046385.3A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The i