EUVD-2026-71420

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777 futex/pi: Plug private futex exec() race

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777 futex/pi: Plug private futex exec() race

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

Linux Distros Unpatched Vulnerability : CVE-2026-76060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitiz...

PT-2026-85618

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futex key and copied into the pi state, is the same as the owner's mm is not sufficient for exec. exec has a gap...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: This issue prevents UAF Use-after-Allocation caused by a race condition involving non-leader exec. Wongi and Jungwoo identified and reported a race condition related to non-leader exec, which can lead to UAF. Th...

GHSA-52GF-6RPQ-FGMX OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

MAL-2026-15821 Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

PT-2026-84885

A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell exec of the file crates/openfang-runtime/src/tool runner.rs. This manipulation causes uncontrolled memory allocation. The attack is possible to be carried out remotely. The exploit ha...

CVE-2026-10195

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

CVE-2026-10195 FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

EUVD-2026-69300

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

CVE-2026-10195

FS-Poster WordPress plugin (versions up to and including 8.0.1 ) is vulnerable to authenticated remote code execution via insufficient sanitization of the FFmpeg path parameter before it is passed to the exec() function, combined with missing authorization checks on REST API endpoints. Attackers ...

CVE-2026-10195 FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

CVE-2026-84194 LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname

LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...

CVE-2026-84194 LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname

LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...

The vulnerability of the strtol() function in the su-exec utility allows a attacker to elevate their privileges to root and execute arbitrary code.

The vulnerability of the strtol function in the su-exec utility is related to incorrect conversion of numerical types. Exploiting this vulnerability can allow an attacker to elevate their privileges to root and execute arbitrary code...

PT-2026-84294

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec function, combined with missing authorization checks on the REST API endpoints...

CVE-2026-83524 RedPort Optimizer wXa-223 System Clock datetime.php exec command injection

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be...