openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw

A flaw was found in OpenSSH. The internal-sftp component within sshd incorrectly processes command-line arguments, recognizing only the first nine. This limitation can prevent the application of intended security configurations for SFTP SSH File Transfer Protocol connections, potentially leading ...

CLSA-2026-1792081157 openssh: Fix of 4 CVEs

CVE-2026-106555: reset GSSAPI client state before each authentication attempt upstream 670510d1 - CVE-2026-106553: store delegated GSSAPI credentials only after successful authorization upstream 6f9cd19a - CVE-2026-106583: disallow '$' and '' in a command-line user name upstream 0c4c9a7b -...

CLSA-2026-1792080315 openssh: Fix of 4 CVEs

CVE-2026-106555: reset GSSAPI client state before each authentication attempt upstream 670510d1 - CVE-2026-106553: store delegated GSSAPI credentials only after successful authorization upstream 6f9cd19a - CVE-2026-106583: disallow '$' and '' in a command-line user name upstream 0c4c9a7b -...

CVE-2026-113495

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

CVE-2026-113495

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw

A flaw was found in OpenSSH. The internal-sftp component within sshd incorrectly processes command-line arguments, recognizing only the first nine. This limitation can prevent the application of intended security configurations for SFTP SSH File Transfer Protocol connections, potentially leading ...

CLSA-2026-1792078892 openssh: Fix of 4 CVEs

CVE-2026-106555: reset GSSAPI client state before each authentication attempt - CVE-2026-106553: store GSSAPI delegated credentials only after successful GSSAPI authentication - CVE-2026-106583: disallow '$' and '' in command-line user names - CVE-2026-106585: reject compressed packets that...

openssh: Fix of 4 CVEs

CVE-2026-106555: reset GSSAPI client state before each authentication attempt - CVE-2026-106553: store GSSAPI delegated credentials only after successful GSSAPI authentication - CVE-2026-106583: disallow '$' and '' in command-line user names - CVE-2026-106585: reject compressed packets that...

CLSA-2026-1792158099 openssh: Fix of 4 CVEs

CVE-2026-106555: reset GSSAPI client state before each authentication attempt upstream 670510d1 - CVE-2026-106553: store delegated GSSAPI credentials only after successful authorization upstream 6f9cd19a - CVE-2026-106583: disallow '$' and '' in a command-line user name upstream 0c4c9a7b -...

Astra Linux – vulnerability in rabbitmq-server

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, adding a new user via the management UI could result in the user’s name being displayed in a confirmation message due to improper sanitization of tags. This might allow JavaScript code execution within the...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows Heap-based Buffer Overflows because it mishandles the "-F’.‘” syntax on the command line. This may allow privilege escalation from any user to root. This issue occurs due to the incorrect interpretation of negative sizes in the strncpy function...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. The redis-cli command-line tool and the redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This issue arises due to a vulnerability in the hiredis...

Astra Linux – Vulnerability in exim4

A use-after-free exists in Exim 4.96 through 4.98.1, which could allow users with command-line access to escalate their privileges...

Astra Linux – vulnerability in glibc

The iconv program in the GNU C Library also known as glibc or libc6 version 2.31 and earlier, when invoked with multiple suffixes in the destination encoding TRANSLATE or IGNORE along with the -c option, enters an infinite loop upon processing invalid multi-byte input sequences, resulting in a...

CLSA-2026-1792079433 openssh: Fix of 4 CVEs

CVE-2026-106555: reset GSSAPI client state before each authentication attempt - CVE-2026-106553: store GSSAPI delegated credentials only after successful GSSAPI authentication - CVE-2026-106583: disallow '$' and '' in command-line user names - CVE-2026-106585: reject compressed packets that...

CVE-2026-110925

...

OTinstaller

OTinstaller Install, run, update, and remove open-source command line tools by name. You pick a tool from a list. OTinstaller downloads it into its own folder, runs it, and saves the output. You do not learn a different install method for each tool. otinstaller is published on PyPI version 0.0.1...

CVE-2026-98403

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...

CVE-2026-98403

The Linux kernel contains a vulnerability in the s390/boot component where the append_ipl_block_parm() function can cause an out-of-bounds write . If a command line occupies nearly all of COMMAND_LINE_SIZE, the function passes a zero size to conversion helpers while pointing to a destination one ...

CVE-2026-98403

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...