Security update for dracut (important)

openSUSE security update: security update for dracut ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21639-1 Rating: important References: bsc1274432 Cross-References: CVE-2026-15816 CVSS scores: CVE-2026-15816 SUSE : 7.5...

Security update for xmlrpc-c (moderate)

openSUSE security update: security update for xmlrpc-c ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21633-1 Rating: moderate References: bsc1272769 Cross-References: CVE-2026-15928 CVSS scores: CVE-2026-15928 SUSE : 5.4...

Security update for gstreamer-plugins-bad (moderate)

openSUSE security update: security update for gstreamer-plugins-bad ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21629-1 Rating: moderate References: bsc1268394 Cross-References: CVE-2026-52718 CVSS scores: CVE-2026-52718 SUSE : 6.5...

PT-2026-82853

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

PT-2026-82658

A Command Injection vulnerability exists in the bs SetLimitCli info function within the libshare.so library of LB-link Router AC2100 AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context...

PT-2026-82623

Name of the Vulnerable Software and Affected Versions UI-TARS-desktop mcp-http-server version 1.2.4 prior to commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 Description The startServer.ts file in the mcp-http-server package defaults the listen address to :: when no host is provided. This causes t...

PT-2026-82476

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

PT-2026-82551

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

PT-2026-82585

In openssl encrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...

PT-2026-82661

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.run path, and subprocess.run. An unauthenticated attacker can explo...

PT-2026-82852

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

RockyLinux 10 : ruby (RLSA-2026:50778)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50778 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

Linux Distros Unpatched Vulnerability : CVE-2026-77652

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer...

PT-2026-82574

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

CVE-2026-74712

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

PT-2026-82489

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

PT-2026-82649

Name of the Vulnerable Software and Affected Versions cPanel & WHM versions prior to 11.110.0.141 cPanel & WHM versions prior to 11.134.0.53 cPanel & WHM versions prior to 11.136.0.37 cPanel & WHM versions prior to 11.138.0.2 WP Squared versions prior to 11.138.1.7 Description An eval injection a...

RockyLinux 9 : ruby:3.3 (RLSA-2026:50828)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50828 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

PT-2026-82851

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...