AlmaLinux 10 : environment-modules (ALSA-2026:80664)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:80664 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable h...

EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-4217)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels...

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

Rocky Linux 10.2 [CIQ] Security Update: dovecot / dovecot-debuginfo / dovecot-debugsource / dovecot-devel / etc Multiple Vulnerabilities (crlsa-2026_79371)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202679371 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorrect...

PT-2026-110735

Name of the Vulnerable Software and Affected Versions Grav Git Sync versions 1.0.2 through 3.4.12 Description Authenticated content editors can execute operating system commands by injecting shell substitutions into profile fields. This occurs when gravuser or gravfull author mode is enabled,...

PT-2026-110967

Name of the Vulnerable Software and Affected Versions IBM Maximo Application Suite - Location Service for Esri Component versions 9.0 through 9.2 Description Command injection is possible due to improper sanitization of a user-controlled value passed to a shell command within a Kubernetes operato...

PT-2026-110868

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description Command injection is possible via remote manipulation of the readE2P argument within a function in the /goform/formWlanMP endpoint. This issue affects products that are no longer supported by the...

PT-2026-110530

Name of the Vulnerable Software and Affected Versions Tuleap Enterprise Edition versions 17.0 through 17.5 Description An OS Command Injection issue exists that could allow an attacker to execute arbitrary commands on the server. OS Command Injection is a flaw where an application passes unsafe...

CVE-2020-37279: Improper Neutralization of Special Elements used in an OS Command

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...

PT-2026-110915

Name of the Vulnerable Software and Affected Versions easy-pdf-merge versions 0.1.0 through 0.2.6 Description An OS command injection flaw allows attackers to execute arbitrary commands by injecting shell metacharacters into the source paths, destination path, or the maxHeap option. This occurs...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791820273)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791820273 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a differen...

CVE-2026-109570: Missing Authentication for Critical Function

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC...

PT-2026-110946

Name of the Vulnerable Software and Affected Versions Fire-Boltt BSW013 firmware versions prior to V0.0.9 Description Missing authentication allows unpaired attackers within Bluetooth range to inject notifications by writing to the proprietary BLE command characteristic. Attackers can craft...

PT-2026-110936

Name of the Vulnerable Software and Affected Versions Continue CLI @continuedev/cli versions prior to 1.5.48 Description A permission bypass exists where the Bash allow-rules use prefix matching on the entire command string. This allows an attacker to execute unapproved commands by chaining them...

CVE-2026-108817: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.runshell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be...

PT-2026-110614

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description The software uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the...

CVE-2026-103528: Improper Neutralization of Special Elements Used in a Template Engine

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

ALSA-2026:80664 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...