AlmaLinux 9.2 [TuxCare] Security Update: systemd / systemd-boot-unsigned / systemd-container / systemd-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787064068)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787064068 advisory. - In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output...

AlmaLinux 9.2 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc (ALMALINUX9.2:CLSA-2025:1754939879)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1754939879 advisory. - BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacen...

Rocky Linux 9.6 [TuxCare] Security Update: libinput / libinput-devel / libinput-test / libinput-utils (ALMALINUX9.6:CLSA-2026:1784020479)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784020479 advisory. - In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to...

ALSA-2026:73998 Important: gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure Shell File Transfer Protocol SFTP, Web Distributed Authoring and Versioning WebDAV, Common Internet File System CIFS, Server Message Block SMB, and...

RHEL 10 : gvfs (RHSA-2026:73998)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73998 advisory. GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol...

CVE-2026-102490: Undefined Security Weakness

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root...

AlmaLinux 9.2 [TuxCare] Security Update: iscsi-initiator-utils / iscsi-initiator-utils-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787396809)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787396809 advisory. - An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open- iscsi allows remote MITM...

PT-2026-103545

Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description A privilege escalation issue exists where an attacker with local access and code execution capabilities as an unprivileged backend service account on the appliance can escalate their...

RHEL 8 : pcp (RHSA-2026:73767)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73767 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

VulnCheck KEV: CVE-2026-102490

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489...

CVE-2026-86131

A code injection vulnerability exists in the WatchGuard Fireware OS during the handling of BOVPN Over TLS client configurations. This flaw allows an attacker who controls a remote VPN server to execute arbitrary commands with root privileges on the connecting Firebox . No specific patch versions ...

CVE-2026-86131 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox...

CVE-2026-86131 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox...

CVE-2026-91191

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

CVE-2026-84409

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update...

CVE-2026-91191

The Lantronix G520 Series Cellular Gateway is vulnerable to an improper verification of cryptographic signatures in its update mechanism. During boot, the stock done function disables signature verification in the OPKG configuration before restoring packages from an unsigned feed. Furthermore, th...

CVE-2026-91191 Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

CVE-2026-91191 Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

CVE-2026-84409

The Lantronix G520 Series Cellular Gateway is vulnerable to a Cross-site Scripting (XSS) flaw in its update mechanism. The device retrieves update metadata over an unencrypted HTTP connection and stores it; a management interface then returns this data in a JSON response, which the web interface ...

CVE-2026-84409 Lantronix G520 Series Cellular Gateway Cross-site Scripting

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update...