Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1774022191)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774022191 advisory. - The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation...

CentOS Linux 8.5 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1778087756)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1778087756 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web...

CentOS Linux 8.4 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS8.4:CLSA-2026:1781081927)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1781081927 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1773136115)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773136115 advisory. - When passing data to the b64decode, standardb64decode, and urlsafeb64decode functions in the base64 module the characters +/ will...

CVE-2026-102099: Improper Limitation of a Pathname to a Restricted Directory

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially...

AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2026:1782204526)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782204526 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use t...

CVE-2026-51870

DeepTutor version 1.4.0 is vulnerable to OS command injection within the execute function of the /tutorbot/agent/tools/shell.py:ExecTool component. This flaw allows for remote command execution due to the improper neutralization of special elements used in an OS command. While the CVSS v3.1 score...

CVE-2026-51858

The camel-ai camel software versions v0.2.91a1 , v0.2.91a2 , and v0.2.91a3 are vulnerable to arbitrary shell command execution. The root cause is located in the TerminalToolkit.shell_exec function, which allows prompt-driven command execution without an approval boundary . This flaw falls under C...

EUVD-2026-90413

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...

CVE-2026-102794 Ziroom ZHOME A0101 ping command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102794

The Ziroom ZHOME A0101 1.0.1.0 is vulnerable to a command injection flaw due to improper processing of the url argument within the /api/ZRnetwork/ping file. This vulnerability allows for remote attack execution. While the exploit has been disclosed to the public and may be used, the vendor has no...

CVE-2026-102794 Ziroom ZHOME A0101 ping command injection

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102792

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-102793

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located in the set_time_zone function within the /api/ZRFirmware/set_time_zone file. An attacker can achieve remote command execution by manipulating the hostname/zonename argument. The documents indicate...

CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-102792 Ziroom ZHOME A0101 set_syslog command injection

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

CVE-2026-102792 Ziroom ZHOME A0101 set_syslog command injection

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

CVE-2026-102792

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located in the set_syslog function within the /api/ZRnetwork/set_syslog file. By manipulating the conloglevel or log_size arguments, a remote attacker can execute arbitrary commands. The documents confirm...