CVE-2021-47949 CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to...

CVE-2021-47949

CVE-2021-47949 affects CyberPanel 2.1 and enables authenticated remote code execution via a symlink attack in the filemanager endpoint. An attacker can modify the completeStartingPath in POST requests to /filemanager/controller to create symbolic links, read sensitive files (e.g., database creden...

PT-2026-39523

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to...

OPENSUSE-SU-2026:10739-1 assimp-devel-6.0.5-2.1 on GA media

These are all security issues fixed in the assimp-devel-6.0.5-2.1 package on the GA media of openSUSE Tumbleweed...

Advisory ROSA-SA-2026-3261

Software: kernel 4.18.0 OS: ROSA Virtualization 2.1 unaffected versions = kernel-4.18.0-553.123.1.el810 affected versions lock, allowing a local attacker to cause a denial of service or execute arbitrary code when frequently switching a thread simultaneously with opening/closing a related subt...

PT-2026-38532

These are all security issues fixed in the libtree-sitter0 26-0.26.8-2.1 package on the GA media of openSUSE Tumbleweed...

alloy-1.16.0-2.1 on GA media (moderate)

alloy-1.16.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:10669-1 Rating: moderate Cross-References: CVE-2026-4427 CVSS scores: CVE-2026-4427 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-4427 SUSE : 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

Yeapook WDR201A WiFi Extender 操作系统命令注入漏洞

The Yeapook WDR201A WiFi Extender is a wireless signal extension device from the Yeapook company. The Yeapook WDR201A WiFi Extender HW V2.1 version and FW LFMZX28040922V1.02 version have a vulnerability related to operating system command injection. This vulnerability stems from insufficient inpu...

OPENSUSE-SU-2026:10680-1 python311-django-allauth-65.16.1-2.1 on GA media

These are all security issues fixed in the python311-django-allauth-65.16.1-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10669-1 alloy-1.16.0-2.1 on GA media

These are all security issues fixed in the alloy-1.16.0-2.1 package on the GA media of openSUSE Tumbleweed...

Exploit for Deserialization of Untrusted Data in Apache Mina

CVE-2026-42779 — Apache MINA Deserialization Filter Bypass to...

GHSA-995C-6RP3-4M4X Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)

The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a stat...

GHSA-VF5J-865M-MQ7C Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them for static classes or primitive types does not check the class at all, bypassing the classname...

CVE-2026-7519

A vulnerability has been found in Fujian Apex LiveBOS up to 2.0. Impacted is an unknown function of the file /feed/UploadImage.do of the component Endpoint. Such manipulation of the argument filename leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to t...

CVE-2026-7519

A vulnerability has been found in Fujian Apex LiveBOS up to 2.0. Impacted is an unknown function of the file /feed/UploadImage.do of the component Endpoint. Such manipulation of the argument filename leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to t...

PT-2026-36261

Name of the Vulnerable Software and Affected Versions Fujian Apex LiveBOS versions prior to 2.1 Description A path traversal issue exists in the Endpoint component. A remote attacker can manipulate the filename argument in the '/feed/UploadImage.do' endpoint to access or overwrite files outside t...

OPENSUSE-SU-2026:10630-1 azure-storage-azcopy-10.32.2-2.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.2-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-41427 Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict...

OPENSUSE-SU-2026:10608-1 libXpm-devel-3.5.18-2.1 on GA media

These are all security issues fixed in the libXpm-devel-3.5.18-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-34870

Name of the Vulnerable Software and Affected Versions libXpm versions prior to 3.5.18-2.1 Description An issue exists in the image parsing functionality of libXpm. Recommendations Update to version 3.5.18-2.1...