Security update for dracut

This update for dracut fixes the following issue: CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

SUSE-SU-2026:3598-1 Security update for dracut

This update for dracut fixes the following issue: - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432...

(Pwn2Own) Home Assistant Green mDNS Server-Side Request Forgery Vulnerability

This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mDNS service. The issue results from the lack of...

CVE-2026-72603 wg-easy wg-easy - OS Command Injection

An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file witho...

CVE-2026-72603

CVE-2026-72603 affects wg-easy 15.3.0. An OS command injection exists when newline-delimited WireGuard PostUp directives are injected into the client name field, which is written to the WireGuard configuration without neutralizing newlines. This allows an attacker with the clients.create permissi...

PT-2026-70147

Name of the Vulnerable Software and Affected Versions wg-easy version 15.3.0 Description An OS command injection issue exists where users with the clients.create permission can execute arbitrary commands as root. This occurs because the client name field is written to the WireGuard configuration...

CVE-2026-72886

Summary : Dokploy PaaS contains an access-control logic flaw in schedule.create/schedule.update (server/dokploy/apps/dokploy/server/api/routers/schedule.ts). From versions 0.29.2–0.29.13, the code derives serviceId from applicationId or composeId and executes the owner/admin host-schedule gate on...

CVE-2026-72886

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch...

EulerOS 2.0 SP11 : libinput (EulerOS-SA-2026-3131)

According to the versions of the libinput packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary...

EulerOS 2.0 SP11 : libinput (EulerOS-SA-2026-3076)

According to the versions of the libinput packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary...

CVE-2026-15816 Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

EUVD-2026-54248

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-61477

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

CVE-2026-18367

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6...

CVE-2026-18367

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6...

CVE-2026-15734 WGDashboard Server-Side Template Injection vulnerability

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-15734 WGDashboard Server-Side Template Injection vulnerability

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-15734 WGDashboard Server-Side Template Injection vulnerability

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

EulerOS 2.0 SP13 : dnsmasq (EulerOS-SA-2026-3013)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Denial of Service DoS vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS...