CVE-2026-109570: Missing Authentication for Critical Function

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC...

PT-2026-110946

Name of the Vulnerable Software and Affected Versions Fire-Boltt BSW013 firmware versions prior to V0.0.9 Description Missing authentication allows unpaired attackers within Bluetooth range to inject notifications by writing to the proprietary BLE command characteristic. Attackers can craft...

PT-2026-110936

Name of the Vulnerable Software and Affected Versions Continue CLI @continuedev/cli versions prior to 1.5.48 Description A permission bypass exists where the Bash allow-rules use prefix matching on the entire command string. This allows an attacker to execute unapproved commands by chaining them...

CVE-2026-108817: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.runshell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be...

PT-2026-110614

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description The software uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the...

CVE-2026-103528: Improper Neutralization of Special Elements Used in a Template Engine

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-4217)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels...

EulerOS 2.0 SP13 : dracut (EulerOS-SA-2026-4043)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic...

AlmaLinux 10 : environment-modules (ALSA-2026:80664)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:80664 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable h...

Rocky Linux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.6:CLSA-2026:1791456473)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791456473 advisory. - Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4,...

EulerOS 2.0 SP11 : dracut (EulerOS-SA-2026-4224)

According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options,...

Rocky Linux 10.2 [CIQ] Security Update: dovecot / dovecot-debuginfo / dovecot-debugsource / dovecot-devel / etc Multiple Vulnerabilities (crlsa-2026_79371)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202679371 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorrect...

TencentOS Server 4: crash (TSSA-2026:1082)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1082 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

ALSA-2026:80664 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

CVE-2026-82108: Improper Control of Generation of Code

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-108895: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MACaddr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the...

PT-2026-110858

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description Remote command injection is possible due to improper processing of the /goform/formAutoFWupgrade endpoint. An attacker can execute arbitrary commands by manipulating the tftpsIP argument. Recommendatio...

CVE-2026-108917: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclos...

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

PT-2026-110608

Name of the Vulnerable Software and Affected Versions Linksys E1700 version 1.0.0.4.003 Description Remote OS command injection is possible through the manipulation of the 6rd prefix and 6rd prefix len arguments within the setLinksysIpv6 function located in the /goform/setLinksysIpv6 file...