https://vulnogram.org/ Most recent CVEs assigned by The illumos project (illumos). https://vulnogram.org/seaview/icons/illumos.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:08 GMT https://vulnogram.org/CVE-2026-104115 https://vulnogram.org/CVE-2026-104115 A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the host and path c… Medium Fri, 09 Oct 2026 14:24:52 GMT https://vulnogram.org/CVE-2026-104114 https://vulnogram.org/CVE-2026-104114 A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a reque… Medium Fri, 09 Oct 2026 14:22:14 GMT https://vulnogram.org/CVE-2026-104112 https://vulnogram.org/CVE-2026-104112 A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are pass… Medium Fri, 09 Oct 2026 14:19:29 GMT https://vulnogram.org/CVE-2026-104116 https://vulnogram.org/CVE-2026-104116 A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src… Low Fri, 09 Oct 2026 14:18:09 GMT https://vulnogram.org/CVE-2026-104113 https://vulnogram.org/CVE-2026-104113 A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door… Medium Fri, 09 Oct 2026 14:17:00 GMT https://vulnogram.org/CVE-2026-104117 https://vulnogram.org/CVE-2026-104117 A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not… Low Fri, 09 Oct 2026 14:15:42 GMT https://vulnogram.org/CVE-2026-102916 https://vulnogram.org/CVE-2026-102916 A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/v… Medium Fri, 09 Oct 2026 14:12:08 GMT https://vulnogram.org/CVE-2026-15422 https://vulnogram.org/CVE-2026-15422 The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec p… Critical Network Exploitable Thu, 16 Jul 2026 19:29:13 GMT https://vulnogram.org/CVE-2026-15449 https://vulnogram.org/CVE-2026-15449 A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_… Medium Thu, 16 Jul 2026 19:27:16 GMT