PT-2026-82489

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

PT-2026-82649

Name of the Vulnerable Software and Affected Versions cPanel & WHM versions prior to 11.110.0.141 cPanel & WHM versions prior to 11.134.0.53 cPanel & WHM versions prior to 11.136.0.37 cPanel & WHM versions prior to 11.138.0.2 WP Squared versions prior to 11.138.1.7 Description An eval injection a...

RockyLinux 10 : ruby (RLSA-2026:50778)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50778 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

TencentOS Server 3: go-toolset:rhel8 (TSSA-2026:0888)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0888 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:3800-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3800-1 advisory. Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues...

RockyLinux 9 : ruby:3.3 (RLSA-2026:50828)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50828 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

Security update for rsync (important)

openSUSE security update: security update for rsync ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21650-1 Rating: important References: bsc1269039 bsc1269040 bsc1269041 bsc1269042 bsc1269043 bsc1269044 bsc1269045 bsc1269046 bsc1269047 bsc1269048...

Security update for rmt-server (important)

openSUSE security update: security update for rmt-server ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21640-1 Rating: important References: bsc1261388 bsc1261398 bsc1261406 bsc1261417 bsc1261426 bsc1261436 bsc1261447 bsc1261458 bsc1261466...

Linux Distros Unpatched Vulnerability : CVE-2026-77652

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer...

TencentOS Server 3: freerdp (TSSA-2026:0918)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0918 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-82661

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.run path, and subprocess.run. An unauthenticated attacker can explo...

PT-2026-82852

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

PT-2026-82851

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

PT-2026-82853

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

...[ More ]

Chronicle Wire's MethodReader implements message dispatch by dynamically mapping serialized wire events to Java handler methods. During initialization, the framework discovers public methods exposed by the registered handler interfaces and registers those methods as callable wire events. When a...

Escargot 4.3.0-214-gfaee4437 Command Injection

An OS command injection vulnerability exists in the Escargot version 4.3.0-214-gfaee4437 crash handler due to an executable/module path being incorporated into an addr2line shell command without quoting or escaping. The resulting command is executed using system, causing shell metacharacters...

TencentOS Server 3: dracut (TSSA-2026:0902)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0902 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

PT-2026-82486

Name of the Vulnerable Software and Affected Versions Zbtlink L3 V2 8 version 3.0.0.4.528 Zbtlink WE826-T2 version 19.1101 Zbtlink ZBT-7628 version 1.0.0.2.007 Zbtlink ZBT-ZBT7621 version 1.0.0.3.001 MoreQuick MQAC-7620 version 1.0.0.2.000 MoreQuick MQAC-7620A version 1.0.0.2.000 MoreQuick...

PT-2026-82570

The execute ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...