PT-2026-82213

Name of the Vulnerable Software and Affected Versions bestzip versions prior to 2.2.6 bestzip versions prior to 3.0.2 Description The software constructs the argument list for the system zip utility without separating options from operands. Because the destination archive path and caller-supplied...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kf5-kconfig (UTSA-2026-093173)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093173 advisory. In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098687)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098687 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARNON for device endpoint command timeouts This commit addresses a rarely...

Linux Distros Unpatched Vulnerability : CVE-2026-80576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user- supplied ibbytes through to ib-lengthdw without a limit,...

Linux Distros Unpatched Vulnerability : CVE-2026-80570

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped...

PT-2026-82340

Name of the Vulnerable Software and Affected Versions community.general Ansible collection affected versions not specified Description A flaw exists in the ipa getkeytab module where the bind pw parameter, used for LDAP simple-bind passwords during Kerberos keytab retrieval, lacks the no log...

PT-2026-82046

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host for Linux versions prior to 15.81.5 Description A command injection issue exists that allows a remote attacker to execute arbitrary commands with the privileges of the current user. This occurs when a user click...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: pcp (UTSA-2026-104833)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104833 advisory. A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098812)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098812 advisory. In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across...

MiracleLinux 9 : pcp-6.3.7-8.el9_8.4 (AXSA:2026-1662:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1662:02 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets...

PT-2026-82254

Name of the Vulnerable Software and Affected Versions Dell PowerProtect One versions 20.1.0.0 and earlier Description An improper neutralization of special elements used in an OS command allows a low privileged attacker with remote access to perform OS Command Injection, which can lead to remote...

Tenable Security Center SCAP Audit File Command Injection

This is a Metasploit module that demonstrates how Tenable Security Center versions prior to 6.9.0 allow an authenticated user to achieve command execution as the web service account tns via the SCAP audit file upload flow. This module requires Metasploit: https://metasploit.com/download Current...

goshs v2.1.6

You're mid-engagement. You need to transfer a file, catch an SMB hash, or stand up a quick HTTPS server — and python3 -m http.server won't cut it. goshs is a single-binary file server built for the moments when you need more than Python's SimpleHTTPServer but don't want to configure Apache. HTTP/...

CVE-2026-57171 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...

CVE-2026-57171

Trestle (compliance-trestle), a Python SDK and CLI for managing OSCAL compliance documents, is affected by an arbitrary file write via path traversal in the catalog-generate, profile-generate, and ssp-generate author commands. The output argument is joined onto the Trestle root but guarded only b...

EUVD-2026-66225

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...

CVE-2026-57171 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...

CVE-2026-57171 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...

EUVD-2026-66211

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectioninclude and mdcleaninclude re-parse the content of an included Markdown file as Jinja2 template co...

CVE-2026-57170

compliance-trestle (Trestle), a Python SDK for managing OSCAL compliance documents, is vulnerable to server-side template injection in versions prior to 3.12.4 and 4.0.0 through 4.0.3. The custom Jinja2 include tags (mdsection_include and md_clean_include) re-parse included Markdown file content ...