Rocky Linux 10.2 [CIQ] Security Update: ruby4.0 / ruby4.0-debuginfo / ruby4.0-debugsource / ruby4.0-devel / etc Multiple Vulnerabilities (crlsa-2026_50773)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202650773 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1777568566)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777568566 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a...

CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777457441)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777457441 advisory. - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module...

Rocky Linux 8 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc Multiple Vulnerabilities (crlsa-2022_5818)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225818 advisory. openssl: crehash script allows command injection CVE-2022-1292 openssl: the crehash script allows command injection CVE-2022-2068 openssl: AES OCB fails to...

PT-2026-103957

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description The foreman-tail utility is susceptible to OS command injection resulting from the unsafe implementation of the eval command. The script incorporates user-supplied arguments into a string...

CVE-2026-12542: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

hammer_cli - Insecure interpolation of the $EDITOR environment variable

A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1773222843)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1773222843 advisory. - There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during...

rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths

A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNCCONNECTPROG variable, daemon hooks, rsync-ssl, and...

Important: Red Hat Security Advisory: rsync security, bug fix, and enhancement update

An update for rsync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-102133

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned...

CVE-2026-102114

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...

CVE-2026-102096

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

CVE-2026-102114 Kiteworks Core OS Command Injection

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...

CVE-2026-102114

A command injection vulnerability exists in Kiteworks that allows a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges. No specific r...

EUVD-2026-90305

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...

CVE-2026-102114 Kiteworks Core OS Command Injection

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...

CVE-2026-102120 Kiteworks Core OS Command Injection

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102120

A privilege escalation vulnerability exists in Kiteworks due to insufficient input validation within an internal cluster management function. This flaw allows an attacker who already has code execution on one node of a clustered Kiteworks deployment to execute operating system commands with eleva...

CVE-2026-102133 Kiteworks Core Arbitrary File Write through Command Injection

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned...