Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud is affected by multiple security vulnerabilities.

Summary This release addresses security vulnerabilities in application and operator images of ELM on Hybrid Cloud. The identified vulnerabilities affect OS packages and Go standard library packages and impact the product in the deployed environment. Two of the vulnerabilities are rated high, with...

lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode

A flaw was found in lrzsz. When operating in pipe mode, the lrz receive utility does not properly sanitize file names received during file transfers before passing them to the system shell. A remote attacker can exploit this flaw by sending a specially crafted file name, leading to arbitrary...

PT-2026-123356

Name of the Vulnerable Software and Affected Versions Avocent ACS8000 versions prior to 2.32.4 Description The root-privileged wsserver terminal-bridge daemon allows a connected client to execute arbitrary commands on the appliance as root. This occurs because the daemon constructs a shell comman...

CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc (CENTOS7:CLSA-2026:1792771843)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792771843 advisory. - A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed b...

Asciidoctor Include Ext 0.3.0 Command Injection

Asciidoctor Include Ext versions prior to version 0.4.0 contain a command injection vulnerability when rendering user-supplied AsciiDoc markup. This proof of concept demonstrates the issue through an include directive. https://packetstorm.news/download/237642...

PT-2026-125127

A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish...

Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

CVE-2026-113951

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...

CVE-2026-113951

An attacker with filesystem write access within a container k8s cluster container can exploit this vulnerability by planting an exec credential plugin in /etc/kubernetes/admin.conf. When a user pulls the cluster's kubeconfig onto a macOS host (using container k8s write-config or create) and subse...

CVE-2026-113951

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...

EUVD-2026-109181

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...

CVE2026

php2shell — CVE-2026-109618 / CVE-2026-109619 Critical Ad...

ROS-20261023-73-0005

The vulnerability of the findbasepath function in the SSHFS file system lies in the ability to exploit or modify arguments. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

PT-2026-122222

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...

Juniper Networks J-Web Arbitrary Command Execution

The vulnerability in the J-Web management web interface of Juniper Networks Junos OS is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges remotely...

CVE-2026-79880

A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79854

A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79848

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79848

The AOS-8 operating system is vulnerable to unauthenticated SQL injection vulnerabilities that can lead to Remote Code Execution . While the provided documents do not specify the exact affected component or root cause, the vulnerability allows for remote exploitation without authentication. No sp...

OESA-2026-4512 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. Thi...