Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: zsh (UTSA-2026-061494)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-061494 advisory. In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098701 advisory. In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported...

Tenable Security Center Report Charting Remote Code Execution

This Metasploit module demonstrates how Tenable Security Center versions prior to 6.9.0 allow an authenticated, non-administrative user to achieve code execution as the web service account tns through report generation. This module requires Metasploit: https://metasploit.com/download Current...

PT-2026-82061

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device...

PT-2026-82105

The LoRaWAN application-layer clock-synchronization service parses downlinks in clock sync package callback subsys/lorawan/services/clock sync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK SYNC CMD APP TIME AppTimeAns command the handler then reads a...

PT-2026-81940

mp SetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-82304

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

CVE-2026-75364

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

CVE-2026-75364

Comfast CF-N1-S (firmware 2.6.0.1) and CF-WR630AX (2024-01-30 build) contain a command injection vulnerability in the update_interface_png SET handler within /usr/bin/webmgnt . The display_name parameter is not sanitized; user-controlled input is concatenated via sprintf() into the unquoted shell...

PT-2026-82257

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote...

PT-2026-82306

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability...

PT-2026-82054

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

PT-2026-82259

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

PT-2026-82225

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

PT-2026-82303

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the update interface png SET handler in /usr/bin/webmgnt fails to sanitize the display name parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

PT-2026-82056

Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation flaw allows a network-based actor to perform command injection on the host device. Command injection is a technique where an attacker executes...

CVE-2026-75414

AntFlow V2.0.0 contains a command execution vulnerability in ActivitiTest.java , where user-supplied JUEL (Java Unified Expression Language) expressions are evaluated without input filtering. This allows an attacker to craft malicious expressions that lead to arbitrary command execution on the af...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098843)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098843 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix handling of lrbp-cmd ufshcdqueuecommand may be called two times in a row for...

Linux Distros Unpatched Vulnerability : CVE-2026-77658

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104555)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104555 advisory. In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY...