PT-2026-82059

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device...

PT-2026-82070

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device...

PT-2026-82256

Name of the Vulnerable Software and Affected Versions Dell Cloud Disaster Recovery versions prior to 20.3 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A high privileged attacker with remote access could exploit this fla...

PT-2026-82118

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the regmap sdw mbq poll busy function where the system attempts to call the readable reg callback without verifying if it is set. Because this callback is optional,...

CentOS 9 : gzip-1.12-2.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the gzip-1.12-2.el9 build changelog. - GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state betwe...

SUSE SLED15 / SLES15 Security Update : vim (SUSE-SU-2026:3680-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3680-1 advisory. - CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service bsc1275018. -...

SUSE SLES12 Security Update : vim (SUSE-SU-2026:3677-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3677-1 advisory. - CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service bsc1275018. - CVE-2026-73071: use-after-free in JSON...

Tenable Security Center Report Charting Remote Code Execution

This Metasploit module demonstrates how Tenable Security Center versions prior to 6.9.0 allow an authenticated, non-administrative user to achieve code execution as the web service account tns through report generation. This module requires Metasploit: https://metasploit.com/download Current...

CVE-2026-75414

AntFlow V2.0.0 contains a command execution vulnerability in ActivitiTest.java , where user-supplied JUEL (Java Unified Expression Language) expressions are evaluated without input filtering. This allows an attacker to craft malicious expressions that lead to arbitrary command execution on the af...

PT-2026-81940

mp SetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-82061

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device...

PT-2026-82304

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

PT-2026-82105

The LoRaWAN application-layer clock-synchronization service parses downlinks in clock sync package callback subsys/lorawan/services/clock sync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK SYNC CMD APP TIME AppTimeAns command the handler then reads a...

PT-2026-82306

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability...

PT-2026-82054

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

PT-2026-82225

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

PT-2026-82303

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the update interface png SET handler in /usr/bin/webmgnt fails to sanitize the display name parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

PT-2026-82259

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104555)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104555 advisory. In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104580)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104580 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controll...