CentOS Linux 8.4 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1786012208)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1786012208 advisory. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove...

CentOS Linux 6 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static Multiple Vulnerabilities (CENTOS6:CLSA-2026:1776346717)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1776346717 advisory. - filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation...

CVE-2026-51861: Undefined Security Weakness

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

CVE-2026-51859

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in savedownloadfile src/backend/bisheng/core/cache/utils.py:290...

CVE-2026-51860

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...

CVE-2026-51860

The bisheng software versions 2.3.0 , 2.4.0 , and 2.4.0-beta1 are vulnerable to a Directory Traversal flaw. The vulnerability exists within the src/backend/bisheng/linsight/domain/task_exec.py component. This issue allows for unauthorized access to files or directories outside of the intended sco...

EUVD-2026-90420

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...

EUVD-2026-90419

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

PT-2026-103611

Name of the Vulnerable Software and Affected Versions bisheng versions 2.3.0 through 2.4.0 Description A directory traversal issue exists in the file src/backend/bisheng/linsight/domain/task exec.py. Directory traversal is a flaw that allows an attacker to access files and directories that are...

PT-2026-103610

Name of the Vulnerable Software and Affected Versions bisheng versions 2.3.0 through 2.4.0 Description A directory traversal issue exists in the save download file function located in src/backend/bisheng/core/cache/utils.py:290. Directory traversal is a flaw that allows an attacker to access file...

CVE-2026-51860

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...

CVE-2026-103474: Unrestricted Upload of File with Dangerous Type

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

PT-2026-103546

Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description A privilege escalation issue exists where an attacker with local code execution as an unprivileged backend service account can escalate privileges to root. This occurs because a privileged...

PT-2026-103545

Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description A privilege escalation issue exists where an attacker with local access and code execution capabilities as an unprivileged backend service account on the appliance can escalate their...

AlmaLinux 9.2 [TuxCare] Security Update: NetworkManager / NetworkManager-adsl / NetworkManager-bluetooth / etc (ALMALINUX9.2:CLSA-2026:1788271382)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788271382 advisory. - A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processi...

SUSE CVE-2026-100804

Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

CVE-2026-94204

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, a...

CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

CVE-2026-100292

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , an authenticated request can enable a hidden debug interface . This interface allows additional commands to be sent to a backend service, potentially exposing system-level functionality . If crafted inputs reach the underlying command handler, ...

CVE-2026-102825

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTHREQUEST path reached from server::runstream in russh/src/server/encrypted.rs increments self.common.authattempts but never compares it with server::Config.maxauthattempts. An unauthenticated remote client can continue...