CVE-2026-93425

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...

CVE-2026-79766 Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

USN-8819-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system NFS server daemon; - IPv6 networking; - Netfilter; CVE-2025-38724, CVE-2026-53131, CVE-2026-532...

USN-8819-1 linux, linux-hwe, linux-kvm vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system NFS server daemon; - IPv6 networking; - Netfilter; CVE-2025-38724, CVE-2026-53131, CVE-2026-532...

USN-8816-1 linux, linux-aws, linux-aws-7.0, linux-hwe-7.0, linux-ibm, linux-oracle, linux-raspi, linux-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - S390 architecture; - x86 architecture; - DRBD Distributed Replicated Block Device drivers; -...

USN-8816-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - S390 architecture; - x86 architecture; - DRBD Distributed Replicated Block Device drivers; -...

Exploit for Write-what-where Condition in Linux Linux_Kernel

CVE-2026-43284-DIRTY-FRAG- Detailed technical analysis of CVE-...

libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...

CVE-2026-79680

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared...

TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNKCondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It...

MAL-2026-16486 Malicious code in @baanx/domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15835cd2dd9f3338228b64c997a3d1c1c8950da602e34fbc2adb0435fd0af23c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @baanx/domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15835cd2dd9f3338228b64c997a3d1c1c8950da602e34fbc2adb0435fd0af23c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16485 Malicious code in @baanx/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85072c161314c0eed152e07e4993e5f816b3b85d30fe7f22cabf850fb9ff0e35 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @baanx/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85072c161314c0eed152e07e4993e5f816b3b85d30fe7f22cabf850fb9ff0e35 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

ROS-20260924-73-0080

The vulnerability of the i40e components of the Linux operating system’s kernel is related to incorrect calculation of buffer sizes. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

CVE-2026-97360: Missing Authorization

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...

ROS-20260924-73-0030

The vulnerability of the excludesuperstripes function in the fs/btrfs/block-group.c file of the btrfs file system in the Linux kernel is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

ROS-20260924-73-0067

The vulnerability of the i40e component in the Linux operating system is related to state management errors. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

ROS-20260924-73-0003

The vulnerability of the net/netfilter/ipvs component in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

PT-2026-98307

There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints...