CVE-2026-96659 Foreman: excessive permissions for viewer role on preview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

CVE-2026-96659

A flaw in Foreman allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. This vulnerability can expose sensitive data, including host root passwords . Additionally, if Safemode protections a...

EUVD-2026-81606

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes childprocess...

EUVD-2026-81585

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE...

foreman: Excessive Permissions for Viewer Role on Preview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

Security Bulletin: IBM webMethods Integration Server uses third-party Apache MINA SSHD and Apache MINA Core libraries that are affected CVE-2026-56624

Summary IBM webMethods Integration Server uses third-party Apache MINA SSHD and Apache MINA Core libraries that are affected by CVE-2026-56624. Vulnerability Details CVEID:CVE-2026-56624 DESCRIPTION: Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java libra...

USN-8857-1: KCoreAddons vulnerability

It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary commands in applications that relied o...

USN-8857-1 kf6-kcoreaddons vulnerability

It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary commands in applications that relied o...

CVE-2026-76146

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely...

PT-2026-104050

Name of the Vulnerable Software and Affected Versions RAGFlow version 0.24.0 Description Improper access control exists in the get dataset function within the 'api/apps/evaluation app' endpoint. This flaw allows an attacker to trigger the execution of arbitrary code or commands controlled by the...

CVE-2026-51897

RAGFlow version 0.24.0 is affected by an improper access control vulnerability in the get_dataset() function located within the api/apps/evaluation_app endpoint. This flaw allows an attacker to trigger attacker-controlled code or command execution , depending on the exposed entry. As a temporary ...

CVE-2026-14157: Use of Externally-Controlled Format String

Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface...

Rocky Linux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781350676)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781350676 advisory. - A flaw was found in Samba's handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (crlsa-2025_13935)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202513935 advisory. cmd/go: Go VCS Command Execution Vulnerability CVE-2025-4674 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note th...

CentOS Linux 6 [TuxCare] Security Update: libsmbclient / libsmbclient-devel / samba / samba-client / etc (CENTOS6:CLSA-2026:1781627407)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781627407 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the...

Rocky Linux 10.2 [CIQ] Security Update: cockpit / cockpit-bridge / cockpit-debuginfo / cockpit-debugsource / etc (crlsa-2026_21676)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202621676 advisory. cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI CVE-2026-4802 Tenable has extracted the preceding description block directly...

CentOS Linux 7 [TuxCare] Security Update: emacs / emacs-common / emacs-el / emacs-filesystem / emacs-nox / etc (CENTOS7:CLSA-2024:1728055873)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1728055873 advisory. - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c...

CentOS Linux 7 [TuxCare] Security Update: less (CENTOS7:CLSA-2024:1715672666)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1715672666 advisory. - less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c...

Rocky Linux 10.2 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-data / vim-debuginfo / etc (crlsa-2026_19073)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619073 advisory. vim: arbitrary command execution via modeline sandbox bypass CVE-2026-34982 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: gpsd-minimal / gpsd-minimal-clients / etc (crlsa-2026_65606)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202665606 advisory. gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility CVE-2026-60122 Tenable has extracted the preceding description block directly from...