Astra Linux – Vulnerability in Linux

A issue was discovered in the drivers/accessibility/speakup/spkttyio.c file within the Linux kernel, as of version 5.9.9. Local attackers on systems with the speakup driver could exploit this to carry out a local denial-of-service attack, identified as CID-d41227544427. This issue arises due to a...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible, where a user’s controller is vulnerable to template injection. This issue can occur when facts used in the template do not include special template characters, especially if the user attempts to embed templates within multi-line YAML strings. This flaw allows...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tty: ngsm: requires CAPNETADMIN to attach NGSM0710 ldisc. Any unprivileged user can attach to NGSM0710 ldisc, but it still requires CAPNETADMIN to create a GSM network. Additionally, it requires the initial namespace setting of...

Astra Linux – Vulnerability in netcdf

A issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmldecode, during the parsing of a crafted XML file, performs incorrect memory handling, resulting in an over-reading of the heap-based buffer in the “normalize line endings” feature...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible 2.7.16 and earlier versions, as well as 2.8.8 and earlier, and 2.9.5 and earlier. When a password is set using the “password” argument of the svn module, it is used in the svn command line, thereby exposing it to other users within the same node. An attacker could...

PT-2026-91282

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

PAN-OS Command Line Arbitrary Command Execution

The vulnerability of the command-line interface of the PAN-OS operating system is related to the failure to take measures to neutralize certain special elements. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands on behalf of the root user...

sj v2.8.2

sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...

CVE-2026-90773

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90767

Froxlor versions before 2.3.12 contain an SSH key injection vulnerability in the SshKeys::add() API endpoint. The root cause is improper validation of multi-line SSH public keys , allowing customers to inject arbitrary lines into authorized_keys files. An attacker can exploit this to inject malic...

PT-2026-90834

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorized keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90781: Off-by-one Error

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-li...

curl: libcurl LDAP LDIF: entry DN and attribute names written without RFC 2849 base64 encoding, allowing server line injection

Summary: curl 8.22.0 base64-encodes LDAP attribute values that aren't RFC 2849 SAFE-STRINGs commit 2ba2fe3540, issue 22339, but the entry DN and the attribute names are still written to the LDIF output verbatim. In lib/openldap.c oldaprecv that's the DN clientwritedata, STRCONST"DN: ", bv.bvval,...

CVE-2026-11748

creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:28+00:00| published-proof-of-concept| https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75 2026-09-12 04:32:07+00:00| seen| https://gist.github.com/alon710/c05d2b733514467507b538dab5375550...

CVE-2026-11746

creationtimestamp| type| source ---|---|--- 2026-09-11 21:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvbjqqanfy2g 2026-09-11 22:37:25+00:00| published-proof-of-concept| https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg 2026-09-12...

CVE-2026-11765

CVE-2026-11765 is an argument injection vulnerability (improper neutralization of argument delimiters in a command) in TUBITAK BILGEM Pardus Pen , a Turkish Linux distribution. The issue affects versions before 4.2.1 , which is the recommended fix. The CVSS 3.1 score is 3.3 (LOW) with a local att...

WordPress Auto x LINE plugin <= 1.0.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Auto x LINE versions = 1.0.0...