PT-2026-81383

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of...

PT-2026-81515

Name of the Vulnerable Software and Affected Versions NVIDIA NemoClaw for Linux affected versions not specified Description A flaw in the command-line interface allows an attacker to perform OS command injection. This could result in arbitrary code execution, data tampering, information disclosur...

Security Bulletin: NVIDIA Unified Fabric Manager - August 2026

NVIDIA has released a software update for NVIDIA® Unified Fabric Manager UFM. To protect your system, follow instructions to clone or update this software to version 6.24 or later from the UFM NVIDIA Application Hub. Go to NVIDIA Product Security. Details NVIDIA has released a software update for...

CVE-2026-65099: Improper Neutralization of Special Elements used in an OS Command

NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

The vulnerability in the web interface of the phpMyFAQ web application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the phpMyFAQ web interface is related to insecure temporary files. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-71936 DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service...

CVE-2026-71937

DrayTek VigorSwitch multiple models are affected by a buffer overflow in the poe_schedule_profile function. The root cause is repeated concatenation of scheduling fields (start_date, start_time, duration_time, how_often, weekdays, monthly_date, cycle_duration) into small fixed-size buffers withou...

CVE-2026-71928 DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execu...

CVE-2026-71926

Multiple DrayTek VigorSwitch models are affected by a command injection vulnerability in the setDevice function. The root cause is insufficient sanitization of the username, password, and location fields before command execution, allowing a remote attacker to run arbitrary commands with root priv...

CVE-2026-71923 DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the authset function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

CVE-2026-71918 DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pwencode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability vi...

CVE-2026-71913 DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi

Multiple DrayTek VigorAP models contain a command injection vulnerability in the uploadsettings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input...

CVE-2026-71904 DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerabili...

[SECURITY] [DSA 6462-1] zfs-linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6462-1 [email protected] https://www.debian.org/security/ Aron Xu August 24, 2026 https://www.debian.org/security/faq -...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fixed a hard lockup issue when reading the rxmonitor from debugfs. During I/O operations and simultaneous reads of /sys/kernel/debug/lpfc/fnX/rxmonitor, a hard lockup similar to the call trace below may occur. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Driver core: Bus – Fixed a double-free in the driver API function busregister. For busregister, any error that occurs after ksetregister will cause the @priv variable to be freed twice. This issue was fixed by setting @priv to NU...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, for the dsa interface, in the mxl862xx module, there was a issue where the DSA ports were freed after they had been used. Upon a MDIO CRC error, the mxl862xxcrcerrworkfn function iterates through the DSA por...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fixed a memory leak in the WMI firmware stats. The memory allocated for firmware pdev, vdev, and beacon statistics is not released during rmmod. This issue was fixed by calling the ath11kfwstatsfree function before...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fixed NULL pointer dereferencing in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. The fcpfindfcinterface function currently selects the first...