TencentOS Server 3: sg3_utils (TSSA-2026:0906)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0906 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

RockyLinux 8 : ruby:3.3 (RLSA-2026:50728)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50728 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

RockyLinux 9 : ruby:4.0 (RLSA-2026:50827)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:50827 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:3799-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3799-1 advisory. Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips. Security issues fixed: -...

Security update for gh (important)

openSUSE security update: security update for gh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21663-1 Rating: important References: bsc1266618 bsc1276661 bsc1276662 bsc1276663 bsc1276664 Cross-References: CVE-2026-39821 CVE-2026-64652...

Security update for gstreamer-plugins-bad (moderate)

openSUSE security update: security update for gstreamer-plugins-bad ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21629-1 Rating: moderate References: bsc1268394 Cross-References: CVE-2026-52718 CVSS scores: CVE-2026-52718 SUSE : 6.5...

Security update for qt6-svg (important)

openSUSE security update: security update for qt6-svg ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21626-1 Rating: important References: bsc1250994 Cross-References: CVE-2025-10729 CVSS scores: CVE-2025-10729 SUSE : 7...

Security update for xmlrpc-c (moderate)

openSUSE security update: security update for xmlrpc-c ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21633-1 Rating: moderate References: bsc1272769 Cross-References: CVE-2026-15928 CVSS scores: CVE-2026-15928 SUSE : 5.4...

PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)

This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...

Security update for dracut (important)

openSUSE security update: security update for dracut ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21639-1 Rating: important References: bsc1274432 Cross-References: CVE-2026-15816 CVSS scores: CVE-2026-15816 SUSE : 7.5...

Security update for pcp (moderate)

openSUSE security update: security update for pcp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21636-1 Rating: moderate References: bsc1272922 bsc1272923 bsc1272924 bsc1272925 bsc1272926 bsc1272927 bsc1272928 bsc1272930 Cross-References:...

PT-2026-82551

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

PT-2026-82853

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

PT-2026-82851

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...

Escargot 4.3.0-214-gfaee4437 Command Injection

An OS command injection vulnerability exists in the Escargot version 4.3.0-214-gfaee4437 crash handler due to an executable/module path being incorporated into an addr2line shell command without quoting or escaping. The resulting command is executed using system, causing shell metacharacters...

PT-2026-82610

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description The sanitize argv for debug function fails to sanitize the keyserver bearer token when passed as a positional argument to the 'keyserver set-token' command. Consequently, when the --debug fla...

PT-2026-82476

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially...

PT-2026-82574

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

PT-2026-82489

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...