1473 matches found
PT-2026-89494
Warning: A critical path traversal vulnerability in Plesk Backup Manager allows arbitrary root file writes by authenticated customers. CVE-2026-68487 CVSS3.0: 9.9. Read the advisory https://t.co/GniZ2f5Oox and Patch Patch Patch...
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. cPanel published the...
CVE-2026-21102
Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege...
CVE-2026-21102
Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege...
CVE-2026-21102
This critical (CVSS 4.0: 9.3) vulnerability is a use-after-free in the DualDAR component of Samsung mobile devices, prior to the SMR September 2026 Release 1 . A local privileged attacker can leverage the flaw to execute arbitrary code with root privileges , resulting in high impact on confidenti...
CVE-2026-21102
Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege...
EUVD-2026-74643
Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege...
EUVD-2026-74642
Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege...
CVE-2026-21101
Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege...
CVE-2026-21101
Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege...
Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Vulnerability
The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by a vulnerability. A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator t...
CVE-2026-53581
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...
CVE-2026-78630
CVE-2026-78630 affects Okta Access Gateway due to improper input neutralization in SNMP configuration processing. Shell metacharacters in SNMP configuration values are not sanitized before a privileged script uses them to construct OS commands, allowing an authenticated local user with access to ...
389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...
EUVD-2026-71776
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being...
CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...
GhostLock-5.10
GhostLock 5.10 This is a kernel root exploit for the Amazon Fire Max 11 sunstone and the Fire TV Stick 4K Max 2nd Gen / 2023 karat, adapted from CVE-2026-43499 in CyberMeowfia. Supported devices Two devices are supported, both on Fire OS 8. Each has its own build target. Fire Max 11 sunstone Fire...
CVE-2025-6019
Usage sudo apt install xfsprogs sudo su wget https://raw.githubusercontent.com/boboaung1337/CVE-2025-6019/refs/heads/main/exploit.sh && chmod +x exploit.sh ./exploit.sh Select mode: 1 Local: Create 300 MB XFS image requires root 2 Target: Exploit target system run on victim 3 Manual: Create XFS...
CVE-2026-79682
Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...