EUVD-2026-84362

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client...

CVE-2026-74849

Zohocorp ManageEngine ADSelfService Plus versions prior to build 7001 contain a remote code execution vulnerability in the GINA client . The CNA-assigned CVSS v3.1 score is 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploitable flaw requiring no authentic...

CVE-2026-74849 Remote code execution vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client...

Security Bulletin: Due to the use of Apache HttpComponents Client 5.4, IBM Sterling Control Center is vulnerable to Improper Certificate Validation (CVE-2026-71290)

Summary Apache HttpComponents Client 5.4 is used by IBM Sterling Control Center as part of dependency in httpclient5-5.4.3.jar. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer...

RLSA-2026:69113 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

apr-util security update

An update is available for apr-util. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The mission of the Apache Portable Runtime APR is to provide a free library ...

RLSA-2026:69266 Important: openssh security, bug fix, and enhancement update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: sftp client allows attacker to control downloaded file location...

lwIP TCP/IP Stack MQTT Client Application

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all...

K000163366: Linux kernel vulnerability CVE-2026-31613

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUSSTOPPEDONSYMLINK, smb2checkmessage returns success without any length validation, leaving the symlink parsers as...

[SECURITY] Fedora 44 Update: znc-clientbuffer-0-0.33.20190129git9766a4a.fc44

The client buffer module maintains client specific buffers for identified clients...

CLEANSTART-2026-YX17879 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the argo-cd package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

[SECURITY] Fedora 45 Update: znc-clientbuffer-0-0.34.20190129git9766a4a.fc45

The client buffer module maintains client specific buffers for identified clients...

PT-2026-96849

Name of the Vulnerable Software and Affected Versions Netdata versions prior to 2.10.4 Description The setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket path from the low-privileged netdata service account. An...

PT-2026-97036

Name of the Vulnerable Software and Affected Versions wlc versions prior to 2.0.1 Description The command-line client can send an unscoped API token to an attacker-controlled server when executed within an untrusted repository, pull request checkout, or a directory containing untrusted ancestor...

PT-2026-96832

Name of the Vulnerable Software and Affected Versions Postiz affected versions not specified Description Postiz uses Math.random instead of a cryptographically secure source to generate security-sensitive credentials. This affects OAuth access tokens, authorization codes, client secrets,...

PT-2026-96712

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to build 7001 Description A remote code execution issue exists in the GINA client, which could lead to full system compromise. Recommendations Update to build 7001...

Zoho ManageEngine ADSelfService Plus: CVE-2026-74849: Remote code execution vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client...

CVE-2026-74849: Improper Neutralization of Special Elements used in an OS Command

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client...

CVE-2026-83603: External Control of File Name or Path

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-090675)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090675 advisory. A flaw was found in Python, specifically in the FTP File Transfer Protocol client library in PASV passive mode. The issue is how the FTP client trusts the host from...