Linux Distros Unpatched Vulnerability : CVE-2025-31938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient granularity of access control in some subsystem for some IntelR XeonR 6 Scalable processors with IntelR TDX may allow an information disclosure...

SUSE CVE-2026-68083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

CVE-2026-66148

An authenticated command injection vulnerability was identified in GMS Command-Line Interface CLI 9.5.1 Build 9510.1044 and earlier versions which allows low-privileged local user to execute system commands with root privileges...

CVE-2026-66150

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP...

CVE-2026-14863

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

EUVD-2026-56976

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-11425

A flaw was found in Domoticz. An authenticated attacker can exploit a stored cross-site scripting XSS vulnerability in the mobile dashboard. This allows the attacker to inject malicious code by updating specific device values through the application's programming interface API. When an...

EUVD-2026-56972

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...

CVE-2026-65981

A flaw was found in Coturn, an open-source implementation of TURN and STUN servers. An authenticated attacker who obtains a victim's MOBILITY-TICKET can exploit this vulnerability during a session resume. This allows the attacker to take over the victim's TURN Traversal Using Relays around NAT...

EUVD-2026-56949

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-66150

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP...

CVE-2026-66150

SonicWall Email Security appliances are affected by CVE-2026-66150, a code injection vulnerability that allows an authenticated user with access to the restricted CLI to run arbitrary OS commands with root privileges via SNMP. The issue is described in the PSIRT advisory as affecting SNMP-reachab...

CVE-2026-66149

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...

CVE-2026-66149

CVE-2026-66149 affects SonicWall Email Security appliances. An authenticated user with access to the restricted CLI can exploit a code-injection weakness to run arbitrary OS commands as root via netmask, via a local attack vector. The combined CVSS 3.1 metrics indicate high impact to confidential...

EUVD-2026-56946

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...

CVE-2026-66148

Summary (CVE-2026-66148) An authenticated command-injection vulnerability affects SonicWall GMS CLI in GMS 9.5.1 (Build 9510.1044) and earlier. A low-privilege local user can execute system commands with root privileges via the CLI, enabling local privilege escalation. Affected product: GMS Comma...

CVE-2026-66148

An authenticated command injection vulnerability was identified in GMS Command-Line Interface CLI 9.5.1 Build 9510.1044 and earlier versions which allows low-privileged local user to execute system commands with root privileges...

CVE-2026-19091

The GeoDirectory WordPress plugin (GeoDirectory – WP Business Directory Plugin and Classified Listings Directory)

CVE-2026-68130

A flaw was found in ksmbd, a kernel module for SMB3 protocol server in the Linux kernel. An authenticated attacker can exploit a vulnerability in the NTLM NT LAN Manager authentication process. By manipulating specific fields in the NTLM authentication blob, an attacker can cause a victim's sessi...

CVE-2026-69115

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...