openSUSE 16 Security Update : rav1e (openSUSE-SU-2026:21681-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21681-1 advisory. This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and...

Linux Distros Unpatched Vulnerability : CVE-2026-11873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An Apache-proxied Dogtag CA REST endpoint exposed by IdM POST /ca/rest/certrequests returns HTTP 500 with internal Java stack traces for unauthenticated malform...

PT-2026-84162

An Apache-proxied Dogtag CA REST endpoint exposed by IdM POST /ca/rest/certrequests returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification...

TencentOS Server 4: golang (TSSA-2026:0882)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0882 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51736

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51153

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from th...

kernel: dm log: fix out-of-bounds write due to region_count overflow

A flaw was found in the Linux kernel's device-mapper log dm log component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log...

CVE-2026-19880

A flaw was found in Logback-classic. This path-traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. This occurs because an unsanitized discriminator value, influenced by the attacker for example, via an HTTP header, is used in a file path...

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

A China-nexus cyber espionage actor tracked asFire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System TACACS servers, and Linux management hosts used to route, authenticate, and manage high-value...

CVE-2026-40463

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser...

CVE-2026-40463

WaveSuite is affected by an insufficient role-based access control vulnerability within the CPB Log Files feature. The root cause allows an authenticated low-privilege user to bypass permission restrictions and access pages intended for higher-privilege roles by directly requesting the correspond...

EUVD-2026-68372

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser...

CVE-2026-40463 An Insufficient Role-based Access Control Vulnerability in WaveSuite

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser...

PT-2026-83702

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser...

CVE-2026-40463: Improper Access Control

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser...

PT-2026-83965

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51736

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68750

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51736

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an incorrect access control flaw in the clearSyslog function. Unauthenticated attackers can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi to erase system logs . This vulnerability affects the 4.1.5cu.748_B202...