SUSE SLES15: kernel-livepatch-6_4_0-150600_23_60-default / etc (SUSE-SU-2026:0283-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0283-1 advisory. This update for the SUSE Linux Enterprise kernel 6.4.0-150600.23.60 fixes various security issues The following security issues were fixed: -...

FortiOS Privilege Escalation

The vulnerability of the rest-api-get and rest-api-set configurations in FortiOS systems relates to the disclosure of information through registration files. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

CVE-2025-59103

The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it was noticed that there are two users...

CVE-2026-1420

A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapskcrypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used...

CVE-2026-1420

A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapskcrypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used...

CVE-2026-1420 Tenda AC23 WifiExtraSet buffer overflow

A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapskcrypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used...

EUVD-2026-4691

A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapskcrypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used...

CVE-2026-1419 D-Link DCS700l Web Form setDayNightMode command injection

A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Executing a manipulation of the argument LightSensorControl can lead to command injection. The attack may be launched remotely. The exploit has...

D-Link DCS700l command injection vulnerability

The D-Link DCS700l is a wireless cloud network camera from D-Link Corporation. The D-Link DCS700l version 1.03.09 has a command injection vulnerability. This vulnerability stems from incorrect operations on the parameter “LightSensorControl” in the file /setDayNightMode, which may lead to command...

PT-2026-4753

Name of the Vulnerable Software and Affected Versions Access Manager 92xx hardware revision K7 affected versions not specified Description The Access Manager 92xx hardware revision K7 utilizes a Linux-based operating system, differing from older revisions that used Windows CE. An SSH service is...

PT-2026-6970

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416 Description A security issue exists in the DDNS Service component of D-Link DIR-823X version 250416. The issue relates to the processing of the /goform/set ddns file. Manipulation of the ddnsType, ddnsDomainName,...

PT-2026-6983

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416 Description A security flaw exists in D-Link DIR-823X version 250416. The issue resides within the Configuration Handler component, specifically in the function sub 4208A0 located in the file /goform/set dmz...

PT-2026-4722

A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Executing a manipulation of the argument LightSensorControl can lead to command injection. The attack may be launched remotely. The exploit has...

Tenda AC8 Router DoS

The vulnerability of the setqosMiblist function in the Tenda AC8 router’s microprogramming software lies in the ability to write data beyond the buffer in memory during the processing of the list parameter. Exploiting this vulnerability could allow a malicious actor to cause service failure...

Wavlink Router Set Sys Adm Command Execution

The vulnerability of the setsysadm function in the microprogramming-based routing software of Wavlink WL-WN530H4 lies in the lack of measures taken to sanitize data at the control level when processing the newpass parameter. Exploiting this vulnerability allows a remote attacker to execute...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004952)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004952 advisory. In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packetsetring and packetnotifier When packetsetring releases po-bindloc...

CVE-2026-23008

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix KMS with 3D on HW version 10 HW version 10 does not have GB Surfaces so there is no backing buffer for surface backed FBs. This would result in a nullptr dereference and crash the driver causing a black screen...

CVE-2026-23005 x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATEBVi in guest XSAVE state whenever XFDi=1 When loading guest XSAVE state via KVMSETXSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled features in the saved or to be restored XSTATEBV...

CVE-2026-23005

CVE-2026-23005 is a Linux kernel issue where XSTATE_BV bits for features disabled by XFD can be out of sync with XFD during guest XSAVE/XRSTOR handling. The fix clears XSTATE_BV[i] when XFD[i]=1 during KVM_SET_XSAVE loading of guest state and related WRMSR updates, preventing XRSTOR from #NM and ...

CVE-2026-1081

The Set Bulk Post Categories plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on the bulk category update functionality. This makes it possible for unauthenticated attackers to modify post categorie...