PT-2026-84512

A few highlights: CVE-2026-77089 : Command Center API Auth Bypass, disclosure/availability risk, 9.3 CVSS CVE-2026-77103 : CommServe auth bypass, information disclosure risk, 8.7 CVSS CVE-2026-77104 : CommServe path traversal, information disclosure risk, 8.3 CVSS CVE-2026-77101 : CommServe buffe...

AlmaLinux 9 : ruby:4.0 (ALSA-2026:50827)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:50827 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

Alibaba Cloud Linux 3 : 0280: dracut (ALINUX3-SA-2026:0280)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0280 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-15816: A flaw was found in dracut. The die...

Alibaba Cloud Linux 3 : 0266: pcp (ALINUX3-SA-2026:0266)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0266 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-16524: A command injection flaw i...

RHEL 7 : dracut (RHSA-2026:62269)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62269 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...

openSUSE 16 Security Update : dhcpcd (openSUSE-SU-2026:21692-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21692-1 advisory. Update to 10.5.0. Security issues fixed: - CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service bsc1268980. -...

Alibaba Cloud Linux 3 : 0273: sg3_utils (ALINUX3-SA-2026:0273)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0273 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-16313: A flaw was found in sg3utils. The...

TencentOS Server 4: vim (TSSA-2026:0880)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0880 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

AlmaLinux 9 : ruby:3.3 (ALSA-2026:50828)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:50828 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

PT-2026-84421

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A command injection flaw in the web-based management interface allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host operating...

TencentOS Server 4: rsync (TSSA-2026:0874)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0874 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Grav CMS 2.0.7 - RCE

!/usr/bin/env python3 Exploit Title: Grav CMS 2.0.7 - Remote Code Execution Date: 2026-07-27 Exploit Author: zer0dayf Vendor Homepage: https://getgrav.org/ Software Link: https://github.com/getgrav/grav Version: Grav CMS 2.0.7 Tested on: Ubuntu 22.04 / PHP 8.2 CVE : CVE-2026-65008 """...

ArcadeDB 26.8.0 Path Traversal

ArcadeDB contains a path traversal vulnerability in the create database and drop database server commands. An authenticated root user can supply a crafted database name containing directory traversal sequences to create database files outside the configured database directory or recursively delet...

CVE-2026-82222

CVE-2026-82222 — GiveWP المؤلف: Rx019 CVSS: 10.0 حرج النوع: حقن كائن PHP غير مصادق → تنفيذ أوامر عن بُعد الإضافة: GiveWP give — إضافة التبرعات ومنصة جمع التبرعات المتأثر: تم التصحيح: 4.16.8 الوصف يقوم GiveWP بتخزين lastname الخاص بالمتبرع في جلسة PHP دون تعقيم. عند تقديم تبرع بدون حقل givelast،...

POC-CVE-2026-0073

POC-CVE-2026-0073 تجاوز مصادقة ADB — إثبات المفهوم إثبات مفهوم لأبحاث أمنية بواسطة naheeju إشعار أمني: تم تصحيح CVE-2026-0073 اعتبارًا من 2026-05-01. يتم توفير إثبات المفهوم هذا حصريًا لأغراض البحث الأمني، وتحليل الثغرات، والاختبار المصرح به للأنظمة المتأثرة. جدول المحتويات إخلاء المسؤولية نظرة...

CVE-2026-83524

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be...

CVE-2026-82971

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/nettr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly...

proxy v0.7.0

git-pkgs proxy A caching proxy for package registries. Speeds up package downloads by caching artifacts locally, reducing bandwidth usage and improving reliability. Version Cooldown Most supply chain attacks rely on speed: a malicious version gets published and consumed by automated pipelines...

gradient-untangler

gradient-untangler A local research harness that searches for the exact tokens that make an open-weight language model start its answer the way you specify. Open-weight models ship as ordinary files: config.json, a tokenizer, and one or more .safetensors or .bin shards. A Hugging Face id is only ...

CVE-2026-83524 RedPort Optimizer wXa-223 System Clock datetime.php exec command injection

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be...