EUVD-2026-62858

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-53542 Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-53542

CVE-2026-53542 is a tar option injection vulnerability in Termix , a web-based server management platform, prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-selected file basenames to tar without an end-of-options marker (--) and without ensuring...

CVE-2026-53542 Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-53542 Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-75112

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112

OTTO® Fleet Manager uses an insufficient bcrypt work factor, lowering the computational cost for offline brute-force attacks on stored password hashes if an attacker obtains an unencrypted system backup. CVSS 6.9 (Medium), ADJACENT vector. No exploitation reported; Rockwell advisory SD1791 refere...

CVE-2026-75112 OTTO® Fleet Manager – Weak Password Hashing Configuration

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112 OTTO® Fleet Manager – Weak Password Hashing Configuration

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

EUVD-2026-62694

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-18874 Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...

CVE-2026-76231

A flaw was found in Renovate. Attackers with repository write access can exploit a command injection vulnerability in the hermit manager. This occurs because user-provided dependency names are not properly sanitized when appended to install and uninstall commands. Successful exploitation allows a...

CVE-2026-76229

A flaw was found in Renovate. This arbitrary command injection vulnerability exists within the kustomize manager, where user-provided chart names are not properly sanitized before being used in helm pull commands. An attacker with write access to a repository can exploit this by crafting maliciou...

CVE-2026-70707

creationtimestamp| type| source ---|---|--- 2026-08-19 16:50:26+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-48162 Wazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-44252 Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...

CVE-2026-44252 Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...

CVE-2026-44252 Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...

CVE-2026-76231

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...