CVE-2026-13248

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version...

Language Servers for AWS vulnerable to arbitrary file write

Summary Language Servers for AWS the aws/language-servers project provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink...

CVE-2026-13248 Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version...

CVE-2026-13248

The Honeywell PD45 Industrial Printer (firmware version F10.19.010040 ) contains an Authenticated Remote Code Execution vulnerability within the web management interface. The root cause allows an authenticated user with admin or itadmin account privileges to submit commands written in the Interme...

EUVD-2026-86385

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version...

CVE-2026-13248 Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version...

CVE-2026-61788 @bytebase/dbhub's read-only mode does not prevent database writes

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in...

SUSE CVE-2026-67224

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

podman: Arbitrary file write when importing OCI archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

podman: Arbitrary file write when importing OCI archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

PT-2026-98236

Name of the Vulnerable Software and Affected Versions Honeywell PD45 Industrial Printer versions prior to F10.22.030745 Description An authenticated remote code execution issue exists in the web management interface due to an arbitrary file write in the Intermec Fingerprint Command Interface. An...

Linux Distros Unpatched Vulnerability : CVE-2026-67224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as...

Apache BuildStream 2.8.0 (symlink) Arbitrary File Write

Summary BuildStream is a powerful software integration tool that allows developers to automate the integration of software components including operating systems, and to streamline the software development and production process. Description Apache BuildStream's tar source plugin extracts archive...

Linux Distros Unpatched Vulnerability : CVE-2026-96807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write files at an arbitrary...

CVE-2026-95519

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

MiracleLinux 9 : podman-5.8.2-7.el9_8 (AXSA:2026-1908:10)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1908:10 advisory. podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 podman: golang net/url: Denial of Service from...

CVE-2026-13248: External Control of File Name or Path

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version...

Security update for amazon-ssm-agent (important)

openSUSE security update: security update for amazon-ssm-agent ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21884-1 Rating: important References: bsc1276981 bsc1276994 bsc1278681 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-71556...

SUSE CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...