CVE-2026-28197 Privilege Escalation via Argument Injection in NetBackup Flex OS Shell

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted...

CVE-2026-28197

CVE-2026-28197 is a privilege escalation vulnerability in NetBackup Flex OS (Cohesity), where an authenticated, low-privileged user with access to the management shell can supply a specially crafted input to a privileged administrative command, achieving arbitrary code execution with root-level p...

EUVD-2026-82874

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted...

CVE-2026-28197 Privilege Escalation via Argument Injection in NetBackup Flex OS Shell

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted...

Arbitrary Code Injection

Grav CMS is vulnerable to Arbitrary Code Injection. The vulnerability is due to insufficient validation of uploaded ZIP archives in the Flex Objects plugin, which allows an authenticated attacker to bypass filename validation, upload malicious PHP files to the web root, and execute arbitrary code...

CVE-2026-28197: Improper Neutralization of Argument Delimiters in a Command

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted...

CVE-2026-28198: Improper Verification of Cryptographic Signature

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted roo...

CVE-2026-28199: Improper Verification of Cryptographic Signature

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential...

Grav CMS vulnerable to remote code execution via .zip file upload

Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair o...

EUVD-2026-58633

Grav CMS vulnerable to remote code execution via .zip file upload...

GHSA-R94F-HX44-8JQF Grav CMS vulnerable to remote code execution via .zip file upload

Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair o...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Avoid failures during online resizing due to an overly large flexbgsize. When we perform online resizing on an ext4 filesystem with an excessively large flexbgsize, the following warning is triggered:...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: mvm – Fixed a memory corruption issue A few lines above, space is allocated using kzalloc for: sizeofstruct iwlnvmdata + sizeofstruct ieee80211channel + sizeofstruct ieee80211rate mvm-nvmdata is a struct iwlnvmdata...

SUSE CVE-2026-74384

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104558)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104558 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-104534)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104534 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible...

CVE-2026-56707

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

EUVD-2026-65205

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...