RockyLinux 10 : emacs (RLSA-2026:84591)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:84591 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: emacs: Command injection via crafted filenam...

MiracleLinux 8 : webkit2gtk3-2.54.1-1.el8_10.ML.1 (AXSA:2026-2101:11)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2101:11 advisory. chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read CVE-2026-87596 chromium-browser: angle: ANGLE in Goog...

Totolink X2000R boa formWsc peerRptPin OS command injection vulnerability

Summary A OS command injection vulnerability exists in the boa formWsc peerRptPin functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

Totolink X2000R boa formWizard newPass OS command injection vulnerability

Summary An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

Totolink X2000R boa formUpload() OS command injection vulnerability

Summary A OS command injection vulnerability exists in the boa formUpload functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-118318

A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service...

ROS-20261020-73-0021

The vulnerability of the dependencieslocalcheck method in the application for setting the REBOOT OS parameter redoswelcome is related to the improper elimination of special elements used in the OS command. Exploiting this vulnerability allows a malicious actor to inject special symbols into the...

Totolink X2000R boa formIpv6Setup Static Network Configuration Stack-Based Buffer Overflow Vulnerabilities

Summary Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formWsc peerRptPin functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTT...

PT-2026-118603

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-118653

A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigg...

PT-2026-118670

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-118661

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-112398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix...

PT-2026-118662

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated...

PT-2026-118404

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description On Windows, the software fails to escape the % character when passing arguments to cmd.exe. This occurs because .bat or .cmd files cannot be called directly via child process.spawn and must be...

PT-2026-119739

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type...

ROS-20261020-73-0069

The vulnerability in dovecot is related to deficiencies in the partitioning of the controlled area of the system. Exploiting this vulnerability allows an attacker to execute arbitrary code outside of the isolated programming environment by rewriting the executable files...

PT-2026-118650

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger...

PT-2026-118639

A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application...