CVE-2026-85423: Missing Authentication for Critical Function

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : sg3_utils vulnerability (USN-8874-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8874-1 advisory. Shaomin Chen discovered that sg3utils did not properly sanitize device identification data...

CVE-2026-20321: Missing Standardized Error Handling Mechanism

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This...

SUSE CVE-2026-105326

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...

CVE-2026-105841

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

CVE-2026-105326

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...

EUVD-2026-92637

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...

CVE-2026-105326

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...

Apache Struts2 S2-061 RCE (CVE-2020-17530)

Exploits CVE-2020-17530 S2-061 in Apache Struts 2.0.0–2.5.25: forced OGNL evaluation in tag attributes yields remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-061 forced OGNL RCE CVE-2020-17530.""" import re import urllib.parse from kittysploit import from...

MAL-2026-17568 Malicious code in req-throttle-mini (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in req-throttle-mini (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

ROS-20261005-73-0027

The vulnerability of the Rsync file transfer and synchronization utility is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-106174

Name of the Vulnerable Software and Affected Versions CUPS affected versions not specified Description An argument injection flaw exists in the CUPS scheduler when email notification is configured. The system accepts printer subscription requests containing a mailto notify-recipient-uri, which is...

F5 iControl REST - Remote Command Execution

F5 iControl REST interface is susceptible to remote command execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. This affects BIG-IP 16.0.x before 16.0.1.1, 15.1.x before...

ROS-20261002-73-0010

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2026-104430

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Distribution versions prior to 2.14.12 Amazon SageMaker Distribution versions prior to 3.9.12 Amazon SageMaker Distribution versions prior to 4.0.11 Amazon SageMaker Distribution versions prior to 4.1.11 Amazon SageMaker...

ROS-20261002-73-0006

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CentOS Linux 8 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1781101271)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1781101271 advisory. - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled,...

Rocky Linux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781350676)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781350676 advisory. - A flaw was found in Samba's handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing...

CVE-2026-14157: Use of Externally-Controlled Format String

Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface...